What is a system prompt? The instructions loaded before you type
- glossary
- prompt-engineering
- llm
A system prompt is the set of instructions an application sends to a language model before your message arrives: who the model is, what it may do, how it should answer. You type after it, and in most products you never see it. Tenth glossary entry, and the one where the word "prompt" hides two different things.
- The plain definition. Instructions from the application, not the user, placed ahead of the conversation and usually treated as higher trust.
- Where it sits. First in the context window, on every turn, whether you typed one word or pasted a file.
- What it is not. Not a rule engine. The model reads it and tries to follow it; nothing in the text itself stops the model from drifting.
- In Claude Code. A preset prompt you never see, plus flags to append to it or replace it. Your CLAUDE.md is not part of it.
- The mistake. Writing a hard rule into an instruction file and expecting enforcement. Enforcement is a hook, not a sentence.
The other half of the word, the instruction you type yourself, has its own entry: what is a prompt in AI.
The plain definition
A system prompt is text the application puts in front of the model before the first user message: role, boundaries, tone, tools. The user's messages come after it on every turn, so the system prompt shapes the whole conversation, not one reply.
NIST's glossary defines it as "Application-specific instructions provided in-context to a GenAI system by the model developer or application designer. System prompts are typically prepended to other input, and may be higher-trust than other forms of input" (NIST CSRC glossary, citing NIST AI 100-2e2025). Anthropic's Agent SDK documentation says the same thing from the builder's side: "A system prompt is the initial instruction set that shapes how Claude behaves throughout a conversation" (Modifying system prompts).
Three words in the NIST line carry the meaning. Application-specific: the product writes it, not the person chatting. Prepended: it goes first. Higher trust: the word NIST uses is "may", and it carries the whole caveat. Priority is the default, not a guarantee.
System prompt vs user prompt
Both are text in the same context window. The difference is who wrote it and where it sits. The system prompt comes from the application, sits first, and stays put. The user prompt comes from the person, arrives turn by turn, and can contradict itself. When the two conflict, the system prompt usually wins, and "usually" is the honest word. It is an instruction with priority, not a lock.
What is a system prompt example?
The shortest real example is a role, a boundary and a format: "You are a support assistant for one product. Answer only questions about it. Reply in two sentences or fewer. If you do not know, say so." Four sentences. Each one is a decision the model would otherwise make alone, and each is testable by reading answers back.
A version I would put in front of a documentation bot:
You answer questions about one product using only the documentation provided.
If the answer is not in the documentation, reply "not in the docs" and stop.
Plain text, no lists, two sentences or fewer.
Never quote prices; link to the pricing page instead.
Every line is a check you can run on the output: answered outside the docs, produced a list, quoted a price. A system prompt you cannot test is a mood, and moods drift.
What it means in practice
The system prompt is the part of the context you pay for on every turn and cannot read back. The Claude Code docs simulate a session filling up, and first in line is the system prompt: "Core instructions for behavior, tool use, and response formatting. Always loaded first. You never see it." The simulation prices it at about 4,200 tokens. The docs call the visualization's numbers representative, not a measurement of your session (Explore the context window).
Tools add a system prompt of their own. When an API request includes tool definitions, the platform inserts instructions that teach the model to call them: 286 tokens on Claude Opus 5 with the default tool choice, 406 when a call is forced (Tool use overview). You did not write those lines either.
When changing models, record the prompt and tool configuration together. The Opus 5.5, GPT-6 Sol and Luna migration checks cover the September 2026 releases.
What is a system prompt in Claude Code
Claude Code ships with a preset called claude_code in the Agent SDK. The docs
describe it as "tool usage instructions, security and safety instructions, and
context about the working directory and environment". The interactive
session and claude -p use it by default. The SDK does not: without a
systemPrompt option it falls back to a minimal prompt that covers tool calling
and leaves the safety and environment sections out.
The CLI reference lists the
flags for changing it. --append-system-prompt adds text to the end of the
default. --system-prompt replaces the whole thing. Each has a -file variant. The
Agent SDK page is blunt about the consequence: with a custom prompt you "take
responsibility for replacing the tool guidance and safety instructions your
agent still needs". A fifth flag for print mode,
--exclude-dynamic-system-prompt-sections, moves
the per-machine sections (working directory, git-repo flag, platform, shell, OS
version and auto memory paths) out of the system prompt and into the first user
message, so identical configurations on different machines share one prompt
cache entry.
Most people get one thing wrong: CLAUDE.md does not go into the system prompt. The memory documentation is explicit: "CLAUDE.md content is delivered as a user message after the system prompt, not as part of the system prompt itself" (How Claude remembers your project). The same page describes both CLAUDE.md and auto memory as "context, not enforced configuration".
That matches what I run. My main project's CLAUDE.md is 244 lines, over the docs'
target of "under 200 lines per CLAUDE.md file". The site this post lives on has
a one-line CLAUDE.md that reads @AGENTS.md, the import the docs recommend
when a repository already carries instructions for other agents. And I keep
thirteen role files that load when I type a role name. All three arrive the
same way: as text in the conversation, after the system prompt, with the
priority of a user message.
What people get wrong
| People say | What is true |
|---|---|
| The system prompt is a rule the model cannot break | It is text with higher trust. The docs call instruction files "context, not enforced configuration" and point to a hook for anything that must not happen |
| CLAUDE.md is Claude Code's system prompt | It is "delivered as a user message after the system prompt". The preset is separate and you never see it |
| Longer is safer | Every token is paid on every turn, and the docs tie longer instruction files to lower adherence |
| You can read a product's system prompt | Not through the product. Copies that claim to be leaks cannot be verified and may be a release behind |
| Only chat products have one | Tool use inserts its own hidden instructions, 286 tokens on Opus 5 before you add a word |
What is the system prompt in ChatGPT?
Whatever OpenAI wrote, and you do not get to read it. In a consumer chat product the system prompt is set by the vendor, loaded before your first message, and can change between releases. Copies claimed to be leaks circulate online; I do not quote them, because a leak cannot be verified and may already be stale.
What you can do is test for it: ask the same question in two products and compare tone, refusals and format. Much of the difference is the prompt, not the model.
One example from my own work
A rule against destructive commands in production is exactly the kind of line people write into an instruction file and treat as settled. It is not settled. The file is context. What actually catches such a command is a PreToolUse hook that reads every shell command before it runs, matches it against a list of destructive patterns and holds the call for my approval, with sixteen regression cases behind it: the PreToolUse post.
The lesson generalizes. A system prompt, an instruction file and a role file are three places to put the same sentence, differing only in priority. None of them executes. If a line must hold regardless of what the model decides, it belongs in code outside the model: a hook, a permission rule, a read-only credential. The prompt explains the rule. The hook keeps it.
Where to go deeper
The instruction you write yourself is covered in what is a prompt in AI. The thing reading both prompts is an LLM. Sorting an instruction file into what a model actually follows is the CLAUDE.md audit, and the harness all of this runs in is Claude Code.
Sources: NIST CSRC glossary, system prompt; Modifying system prompts, How Claude remembers your project, CLI reference and Explore the context window in the Claude Code docs; Tool use overview in the Claude platform docs. All read on 4 September 2026.