Definition
System Prompt
A system prompt is a set of instructions given to a language model before any user input, defining its role, behavior, tone, constraints, and the tools or knowledge it should use. It frames every response in the conversation that follows. Unlike a user message, it sets the persistent ground rules the model is meant to honor throughout an interaction.
Key takeaways
- A system prompt is the instruction set given to a model before any user input, defining its role, behavior, tone, constraints, and available tools.
- It sets persistent ground rules for the whole conversation, unlike a single user message — and specificity is what makes it effective.
- For agents it acts as the operating contract: which tools are allowed, escalation rules, and the line between proposing and executing.
- It is not a security boundary by itself; pair it with input handling, least-privilege tool scoping, and approval gates against prompt injection.
A model interaction is built from messages with roles. The system prompt is the first and highest-priority one: it tells the model who it is supposed to be and how to behave before the user says anything. Good system prompts are specific — they state the role, the output format, what to do when unsure, and what is off-limits — because vague instructions produce vague, inconsistent behavior.
The system prompt is also where you wire in capabilities and boundaries: which tools the model may call, what data it has been given, and the policies it must follow. For agents, it is effectively the operating contract — the place that defines allowed actions, escalation rules, and the difference between proposing and executing.
It is not a security boundary on its own. A determined user message can attempt to override or leak system instructions through prompt injection, so the system prompt must be paired with real enforcement — input handling, least-privilege tool scoping, and approval gates — rather than trusted as the sole line of defense.
In Planoda, each agent's system prompt defines its role and is paired with a clamp to an explicitly allowed set of tools inside the tenant's security boundary, so instructions and enforcement reinforce each other.
Related terms
- Large Language Model (LLM)A large language model is an AI system trained on vast amounts of text to predict and generate language, enabling it to answer questions, summarize, write, and reason over natural language. LLMs power modern AI assistants and agents. They are probabilistic next-token predictors, which makes them remarkably capable but also prone to confident errors.
- Prompt InjectionPrompt injection is an attack on AI systems where malicious instructions hidden in user input or retrieved content trick a language model into ignoring its original directives — leaking data, performing unauthorized actions, or producing harmful output. Because models can't reliably separate trusted instructions from untrusted data in their context, it is a fundamental security risk for any LLM application.
- GuardrailsGuardrails are the controls that constrain what an AI system is allowed to do or say, enforced around the model rather than left to the model's judgment. They validate inputs and outputs, block unsafe or off-policy actions, scope which tools an agent may use, and route risky operations through approval — turning a probabilistic model into a system safe to deploy.
- Tool CallingTool calling is the capability that lets a language model invoke external functions — query a database, search the web, create a record — by emitting a structured request the surrounding system executes. Instead of only producing text, the model can take actions and pull in live data, turning it from a text generator into the reasoning core of an agent.
- Agentic WorkflowAn agentic workflow is a process in which one or more AI agents carry out a multi-step task with some autonomy — planning, calling tools, and acting on results in a loop — rather than a human driving each step. The agent decides the next action toward a goal, within boundaries its operator sets, turning AI from a single-response assistant into a worker.