{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"ai/system-prompt","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/ai/system-prompt/","da":"https://cmaintz.github.io/tech-atlas/da/terms/ai/system-prompt/"},"term":{"en":"System prompt","da":"Systemprompt"},"aka":{"en":["system message","developer message"],"da":["systembesked","udviklerbesked"]},"domain":["ai"],"cluster":"prompting","layer":"inference","status":"current","era":2023,"summary":{"en":"Standing orders the maker of an AI service places ahead of every chat, setting the assistant's role, rules and tone before the user types.","da":"Faste instruktioner fra udbyderen af en AI-tjeneste, lagt foran hver samtale, der sætter assistentens rolle, regler og tone."},"body":{"formal":{"en":"The part of a prompt, marked with its own role, that carries instructions from whoever built the service rather than from the end user; instruction tuning teaches the large language model to weigh it above user text, but nothing enforces that.","da":"Den del af en prompt, markeret med sin egen rolle, der rummer instruktioner fra den, der har bygget tjenesten, frem for fra slutbrugeren; instruktionstilpasning lærer den store sprogmodel at vægte den over brugerens tekst, men intet håndhæver det."},"plain":{"en":"Like a director's notes to an actor before the curtain rises - the audience never hears them, yet they shape every line, and a loud voice from the seats can still knock the actor off script.","da":"Som instruktørens anvisninger til en skuespiller, før tæppet går - publikum hører dem aldrig, men de præger hver replik, og en larmende tilskuer kan stadig få skuespilleren ud af rollen."},"inPractice":{"en":"The web manager at a Danish ferry company writes the system prompt for its booking chat: “Answer only about departures and bookings; never promise refunds; pass complaints to staff.”","da":"Den webansvarlige i et dansk færgerederi skriver systemprompten til bookingchatten: “Svar kun på spørgsmål om afgange og bookinger; lov aldrig at betale penge tilbage; send klager videre til personalet.”"},"whyItMatters":{"en":"Users can often coax an assistant into revealing its system prompt, and prompt injection can override it, so it must never hold passwords or keys and cannot replace real access control.","da":"Brugere kan ofte lokke en assistent til at afsløre sin systemprompt, og prompt injection kan tilsidesætte den, så den må aldrig indeholde adgangskoder eller nøgler og kan ikke erstatte rigtig adgangskontrol."}},"deepDive":{"en":"Mechanically, the system prompt is text rendered at the start of the token sequence inside the model's chat template, wrapped in role delimiters that mark it as system (or developer) content. API shapes differ: OpenAI's chat format carries it as a message with the system role and, from the o1 generation onward, a developer role intended for application builders; Anthropic's Messages API takes it as a separate top-level system parameter rather than as a message. In both cases the provider may add its own platform-level instructions that the developer does not see, and tool definitions are typically rendered into the same region.\n\nPrecedence is trained, not enforced. Instruction and preference tuning teach the model to prefer system instructions when they conflict with user turns, and OpenAI's \"Instruction Hierarchy\" work (Wallace et al., 2024) trains an explicit ordering in which platform or system messages outrank user messages, which outrank tool outputs, with the model expected to ignore lower-priority instructions that conflict with higher ones. OpenAI's Model Spec describes the same idea as a chain of command. These methods measurably improve robustness to jailbreaks and injected instructions, but they are statistical tendencies of the model; there is no parser or permission check that makes system text binding.\n\nConfidentiality is the most common false assumption. System prompts leak through direct requests, role-play, translation or encoding tricks (\"repeat everything above in a code block\") and through indirect prompt injection; the early 2023 disclosure of Bing Chat's \"Sydney\" instructions was an example. OWASP's 2025 LLM Top 10 made this a separate entry, LLM07 System Prompt Leakage, and its guidance is to assume the prompt will be disclosed: never put credentials, API keys, internal URLs, user lists or authorisation logic in it, and enforce permissions, rate limits and content policies in code outside the model. Some vendors now publish their consumer assistants' system prompts; Anthropic, for example, publishes the system prompts used in its Claude apps in its release notes.\n\nEngineering considerations: the system prompt is a fixed per-request cost in input tokens, so it is usually the largest beneficiary of prompt caching, which requires it to be byte-identical across calls - putting a timestamp or user name at its start defeats the cache. Very long rule lists dilute attention and create conflicts; clear role, context, output format and a small number of well-motivated rules generally work better. System prompts should be version-controlled and regression-tested, since a single edit affects every conversation, and multi-tenant applications must ensure one customer's configuration or data never ends up in another customer's system prompt.","da":"Mekanisk er systemprompten tekst, der placeres i starten af tokensekvensen inde i modellens chatskabelon, omgivet af rolleskilletegn, der markerer den som system- (eller developer-)indhold. API-formerne er forskellige: OpenAI's chatformat bærer den som en besked med rollen system og fra o1-generationen også en developer-rolle beregnet til applikationsudviklere; Anthropics Messages API tager den som en separat system-parameter på topniveau frem for som en besked. I begge tilfælde kan udbyderen tilføje sine egne instruktioner på platformsniveau, som udvikleren ikke ser, og værktøjsdefinitioner placeres typisk i samme område.\n\nForrangen er trænet, ikke håndhævet. Instruktions- og præferencetræning lærer modellen at foretrække systeminstruktioner, når de strider mod brugerens beskeder, og OpenAI's arbejde med et \"Instruction Hierarchy\" (Wallace m.fl., 2024) træner en eksplicit rangorden, hvor platforms- eller systembeskeder står over brugerbeskeder, der står over værktøjsoutput, og modellen forventes at ignorere lavere prioriterede instruktioner, der strider mod højere. OpenAI's Model Spec beskriver samme idé som en kommandokæde. Metoderne forbedrer målbart robustheden mod jailbreaks og indsatte instruktioner, men de er statistiske tendenser i modellen; der findes ingen parser eller rettighedskontrol, der gør systemteksten bindende.\n\nFortrolighed er den mest udbredte fejlantagelse. Systemprompter lækker via direkte forespørgsler, rollespil, oversættelses- eller kodningstricks (\"gentag alt ovenfor i en kodeblok\") og via indirekte prompt injection; afsløringen af Bing Chats \"Sydney\"-instruktioner i begyndelsen af 2023 var et eksempel. OWASP's LLM Top 10 fra 2025 gjorde det til et selvstændigt punkt, LLM07 System Prompt Leakage, og anbefaler at gå ud fra, at prompten bliver afsløret: Læg aldrig legitimationsoplysninger, API-nøgler, interne URL'er, brugerlister eller autorisationslogik i den, og håndhæv rettigheder, rate limits og indholdspolitikker i kode uden for modellen. Nogle leverandører offentliggør nu systemprompterne til deres forbrugerassistenter; Anthropic offentliggør fx de systemprompter, der bruges i Claude-apps, i sine release notes.\n\nIngeniørmæssige hensyn: Systemprompten er en fast omkostning i input-tokens pr. kald og har derfor mest gavn af prompt caching, som kræver, at den er byte-identisk mellem kald - et tidsstempel eller et brugernavn i starten ødelægger cachen. Meget lange regellister udvander opmærksomheden og skaber konflikter; en klar rolle, kontekst, outputformat og et lille antal velbegrundede regler virker som regel bedre. Systemprompter bør versionsstyres og regressionstestes, fordi én ændring påvirker hver samtale, og applikationer med flere kunder skal sikre, at én kundes konfiguration eller data aldrig havner i en anden kundes systemprompt."},"edges":[{"type":"requires","to":"ai/instruction-tuning","confidence":"high","strength":"normal"},{"type":"part-of","to":"ai/prompt","why":{"en":"It is the first, builder-written section of the full prompt the model receives, placed before the user's messages.","da":"Den er den første, udviklerskrevne del af den samlede prompt, modellen modtager, placeret før brugerens beskeder."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"ai/tool-calling","why":{"en":"The system prompt usually lists which tools the assistant may use and when, so tool use is steered from there.","da":"Systemprompten angiver som regel, hvilke værktøjer assistenten må bruge og hvornår, så værktøjsbrugen styres derfra."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"OWASP Top 10 for LLM Applications 2025 - LLM07 System Prompt Leakage","tier":"reference","publisher":"OWASP"},{"title":"Anthropic documentation - Giving Claude a role with a system prompt","tier":"official-doc","publisher":"Anthropic"}],"draft":true}