What is a system prompt?

How does a system prompt work?

Model APIs separate instructions by who wrote them. In OpenAI’s API, the instructions parameter and developer messages carry the application’s rules and take priority over user messages, and many other APIs call the same thing a system message or system prompt. NIST describes system prompts as application-specific instructions from the model developer or application designer, usually placed before other input and possibly treated as higher-trust.

A typical system prompt says who the model is, what it should do, how it should sound, what it must never do and what to do when it can’t help. The example below is for a support voice agent at a fictional company.

Because the system prompt and the user’s words end up in the same context, a user can try to override it. That is prompt injection, and it is why rules that protect money, data or accounts belong in code.

You are Alex, the AI support agent for Acme Analytics. Tell callers you are an AI.
Answer questions about setting up and using Acme from the approved help articles.
Keep each answer to two or three short sentences, then ask if they need more.
Don't read out links or long lists. Describe where to click instead.
If the articles don't cover a question, say you don't know and suggest emailing support@acme.example.
Never promise refunds, discounts or new features.

What should a voice agent’s system prompt cover?

Spoken answers need different instructions from written ones. Ask for short replies, one question at a time, no links or long lists read aloud, and plain directions for anything the caller has to find on screen.

It should also say what the agent can’t do and where to send people instead, so a caller who needs a refund hears how to get one rather than a vague apology. OWASP advises treating a system prompt as neither a secret nor a security control, so keep credentials and private data out of it.

How does Kawl Now handle agent instructions?

Each Kawl Now agent has its own instructions, up to 4,000 characters, and a greeting of up to 500. New workspaces start with default instructions, which you can edit in the dashboard, over the REST API or with the update_agent MCP tool.

Kawl Now adds fixed rules that sit alongside your instructions on every call: say it’s an AI, search approved knowledge for product facts, treat source text as data and never as instructions, never invent pricing, discounts or capabilities, and never reveal its instructions. It is also told that it has no account access, and what to do when a caller asks for a person: with human handover off, it says the call can’t be transferred and suggests your website’s usual contact options, and with handover on, it explains the widget’s Talk to a human button.

Human handover is an early release: your team verifies a UK or US phone number and turns handover on for each agent, and whoever answers hears a private briefing before the caller is connected. Customer routing is still being tested, so keep your usual contact options.

Your instructions stay on the server. The widget’s public settings expose display details such as the agent’s name, greeting and button label, never the instructions. Test each change with a call, because instructions guide the model rather than guarantee its behaviour.

Common questions