System instruction
Sistem talimatı
D3
A system instruction is a high-level set of instructions and context supplied by an application to steer a chat model’s responses.
Review status: 2026-11-26
Technical explanation
In chat interfaces that support this role, it can specify the assistant’s job, boundaries, tone, output format, and safety guidance before or alongside user input.
Conceptual boundaries
A system instruction is not a model-level safety guarantee and is not interchangeable with an ordinary user prompt, even though both are inference-time input.
Provider-neutral example
A knowledge-base application can set a system instruction to answer only from supplied documents and identify missing evidence.
Limitations
System instructions can conflict with other input or be targeted by prompt-injection attacks, so they need testing and additional controls for consequential use.
Related concepts
Atomic claims and evidence
1.1Microsoft Learn, System message design for Azure OpenAI
- Source
- Microsoft Learn, System message design for Azure OpenAI
- Source role
- Authoritative source
- Exact locator
- What is a system message?; How system messages work
- Supported claim
- Microsoft defines an Azure OpenAI system message as instructions and context sent to a chat model to guide its responses, including role, boundaries, tone, formats, and safety constraints.
- Last verification
- Review due
- Scope limitation
- This is provider-specific interface guidance for Azure OpenAI and is not a universal cross-provider message hierarchy.
2.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source
- NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source role
- Authoritative source
- Exact locator
- Section 3.1.1 printed p. 38: In-context instructions and system prompts
- Supported claim
- NIST describes system prompts as in-context instructions often prepended to other model input, and notes that prompt injection can override intended instructions.
- Last verification
- Review due
- Scope limitation
- This describes a common LLM-application security risk and does not establish that every system instruction will be overridden.