System Prompt

The standing instruction a model carries into every conversation, written by whoever built the product rather than by the person typing. It sets the persona, the format, the things to refuse, and the tools available — and the user never sees it, which is both the point and the problem.

It is not a privileged channel in any architectural sense: it is tokens in the same context window, distinguished only by position and by whatever the model was trained to treat as authoritative. That training is real and imperfect, which is why Prompt Injection works — content arriving later in the context can and does override instructions arriving earlier. Treating the system prompt as a security boundary is the mistake; it is a strong default.

It is also a fixed cost on every request. A long system prompt is prefilled on every call, so its token count multiplies by traffic — which is what makes Prefix Caching worth the ordering constraint it imposes, since the standing instruction is exactly the shared prefix that caches well. The tension is that the same length that makes it reliable makes it expensive, and the two are traded in tokens rather than in argument.