System Prompts and Roles

System Prompts and Roles

When you use ChatGPT or Claude, you type into a chat box and get a response. Simple. But there's more going on behind the scenes — specifically, the concept of roles in a conversation, and the system prompt that shapes the model's behaviour before you say a word.

The Three Roles

Most modern language model APIs structure conversation as a series of messages, each with a role:

System: Instructions from the application developer. Sets the model's persona, constraints, and context. The user typically never sees this.

User: The message from the person interacting with the model (you).

Assistant: The model's response.

As of October 2026: OpenAI's API now labels this role developer rather than system — same idea as described here (developer-authored instructions that outrank the user's messages), just renamed to make clear who authored it.

A conversation might look like this behind the scenes:

System: You are a helpful customer support agent for Acme Software.
        Be concise and professional. Never discuss competitors.

User: How do I reset my password?
Assistant: To reset your password, click "Forgot Password" on the login page.
           You'll receive an email with a reset link within a few minutes.

The assistant's response is shaped entirely by the system prompt — concise, professional, on-brand.

What System Prompts Do

System prompts let developers:

Set a persona: "You are a friendly Welsh-language tutor called Nia."

Define constraints: "Only answer questions about our product. Politely decline anything off-topic."

Provide context: "Today's date is {date}. The user's subscription plan is {plan}."

Set the tone: "Responses should be warm but concise. Use British spelling."

Inject data: Dynamic information about the user, their history, or real-time data can be injected into the system prompt at runtime.

Every AI application you've ever used has a system prompt you never saw. It's the difference between "a raw language model" and "a useful product."

Why This Matters

You are never talking directly to a raw model — you're talking to a model shaped by the developer's system prompt. The chatbot on a bank's website and the same model accessed via API will behave completely differently because of their system prompts.

Prompt injection is a security risk: text the model reads can contain instructions that override what the developer intended. The direct version — a user typing "ignore your previous instructions" — is the easy case to picture. The bigger risk for AI agents is indirect prompt injection: hidden instructions planted in a document, webpage, or email that the model reads as part of its task, which the model then follows as if they were legitimate instructions. Sanitising user text input doesn't catch this, because the attack doesn't come through the user's own message — it comes through content the agent fetches and reads on the user's behalf.

There's no complete fix yet. The main defences are least-privilege tools (only give the model access to the specific actions and data it needs, nothing more, so a successful injection has little to do) and human approval for consequential actions (have a person confirm before the model sends an email, makes a purchase, or changes a file, rather than letting it act autonomously on what it read).

Transparency: Some AI services publish their system prompts (Anthropic publishes Claude's). Others keep them proprietary. You usually can't see it directly, but you can often infer it from how the model behaves.

As a developer, system prompts are your primary tool for customising AI behaviour. They're worth learning to write well — they're the interface between your application and the model.