What is a system prompt?
The Harvard Chan AI Glossary
In our classes, we often pause to explain the ideas behind AI and the language used to describe it. These posts grew out of those conversations. They’re for anyone who would like to understand AI better, with no technical background assumed.
A system prompt is a set of instructions used by an AI application to establish how its conversational model should behave. A model is the part of the software trained to interpret information and generate responses. The system prompt can define its role, tone, boundaries and approach before it answers a particular user’s request.
For example, a language-learning application might instruct its assistant to use simple Spanish, correct one mistake at a time and avoid giving the full answer before the learner has tried. A user then asks a question. The assistant receives both the standing instructions and the immediate request when preparing its response.
This differs from an ordinary user prompt, which usually describes the task for that moment: “Help me practice ordering coffee.” A system prompt supplies broader directions intended to apply across many tasks or turns in the conversation. Different services arrange and name their instruction levels differently, so the exact priority rules depend on the platform.
The instructions influence the model through the text it receives. They do not usually rewrite its learned internal settings. This is why changing a system prompt can change an application’s style without training a new model. Training means adjusting those internal settings using examples; prompting means supplying instructions to a model that already exists.
A system prompt is not a security lock. Telling an assistant not to delete files is different from removing its ability to delete them. Sensitive actions need software-enforced permissions, which determine what the application can actually do. Passwords and other secrets should not be stored in instructions on the assumption that the model will never reveal them.
A patient-portal triage assistant might have standing instructions to use approved clinic guidance, ask clarifying questions about symptom duration and never diagnose a condition or prescribe medication. An uploaded attachment remains evidence to read, even if it contains text telling the assistant to ignore those standing rules—an attack known as prompt injection. The application must enforce access and action limits in software; the system prompt defines the intended role, but should never be the sole barrier preventing an unauthorized clinical action.
Sources: Anthropic — Prompting Best Practices; OpenAI — Model Spec.
If you would like to find out more about AI and improve your leadership skills, consider the AI in Health Care Certificate of Specialization from the Advanced Learning Academy at Harvard T.H. Chan School of Public Health. You can take an individual course or work toward the full certificate.
AI is a fast-moving field. This explanation reflects our class discussions and related material at the time of writing. Terminology, capabilities and tools may change.
For suggested additions or corrections, please email me at tpanch@hsph.harvard.edu.
Dr. Trishan Panch
Program Director, AI in Health Care
Harvard T.H. Chan School of Public Health — Advanced Learning Academy