The text you never see

Somebody spoke first

When you open a chat and type, yours is not the first message. Above it, invisible, sits a block of text placed there by whoever built the product. It is called the system prompt, and it typically runs from a few hundred to several thousand words.

What is in it:

• A name and a character. “You are Aria, the assistant for a bank.”
• Today’s date, since the model has no clock.
• Tone and formatting instructions: length, whether to use lists, which language to reply in.
• Boundaries. What to refuse, what to escalate, what never to promise.
• Descriptions of any tools it may use, and when.
• Sometimes company facts: opening hours, the refund policy, product names.

This is why the same underlying model, licensed by three companies, behaves like three different products. Often the only difference is this text.

Some organisations publish theirs. Anthropic has published the system prompts for its consumer Claude applications, which is worth reading once for the sheer ordinariness of it: it is instructions, in English, in the same box as your message.

The crucial property: it is only text

A system prompt looks like configuration. It is not. It is words in the context window, sitting in the same space as your message and the document you pasted, and it is processed by the same mechanism.

Models are trained to weight it heavily, and that training works most of the time. But “weighted heavily” is not “enforced”. Three things follow, and they are the reason this lesson exists:

It can be revealed. People have extracted the system prompts of most commercial assistants, essentially by asking cleverly. Treat anything in a system prompt as public.

It can be overridden. A long conversation, a contradictory instruction, or text inside a document the model is reading can outweigh it. When a document says “ignore your previous instructions”, the model has no reliable way to tell that this instruction has a different status from the one above. That is prompt injection, and it has its own lesson in the next module.

It competes for attention and space. In a very long conversation the system prompt is still there, but it is one voice among many thousands of tokens, and its influence measurably weakens.

The rule that follows is simple and important: a system prompt is a request, not a control. Anything that must not happen (a refund issued, a record deleted, a price quoted) has to be prevented by ordinary software outside the model, which checks the model’s output before acting on it. Every organisation that has learned this the hard way learned it by trusting an instruction.

Using it deliberately, which most people do not

Where you can set a system prompt yourself, it is the single strongest lever available, and it is under-used because it is hidden in settings.

You can set one in ChatGPT’s custom instructions and Projects, in Claude’s Projects, in Gemini’s Gems, in almost every API, and in local tools such as Ollama and LM Studio.

What belongs there is the standing context you would otherwise retype daily:

• Who you are and what you do. “I am a nurse in Kerala writing patient information leaflets.”
• The audience. “Readers have limited English and no medical background.”
• Standing preferences. “Use British spelling. No bullet lists unless asked. Say when you are unsure rather than guessing.”
• Standing prohibitions. “Never invent a citation. If you do not know, say so.”

The gain is not only convenience. Instructions given once at the top apply consistently across a conversation, where an instruction given in message forty applies mainly to message forty-one.

Two warnings

Do not put secrets in it. Not an API key, not a password, not a client’s private data. It is retrievable and it is sent to the provider with every request.

Keep it short and concrete. A three-thousand-word system prompt full of contradictory rules produces worse behaviour than a two-hundred-word one, because the model must reconcile the contradictions and will do so unpredictably. Write the four things that matter, and test whether each one changes anything by removing it.