System Prompts & Personas

Why Does This Exist?

Say you ship a coding assistant. You want it terse and code first, with two hard rules: never invent an API, always show something runnable. Without a system prompt you would paste those rules into every user message. That burns tokens on each call, and worse, the model reads them as one more thing somebody said, no weightier than the question sitting next to them.

A system prompt fixes both problems at once. You write the persona and the rules a single time, into a separate slot ahead of the conversation, and the provider's tuning treats that slot as standing instruction rather than chat. Every later call carries it automatically, so turn nine behaves like turn one. No retyping, no decay in the first hour.

There is a catch you will feel in long sessions, and it is why this page has neighbours. The system block persists, but it also dilutes: the same short rule set that dominates a fresh chat shrinks to a few percent of a long one, and the persona starts to drift. The budget itself belongs to the context window page, the session tactics belong to context engineering, and any rule that must hold under attack belongs to guardrails. This page covers the standing instruction itself: the slot it lives in, the weight it carries, the dilution math, and the line where instruction stops and enforcement must start.

Think of It Like This

How It Actually Works

On every call you send one ordered list of messages. Call it $M$, the full message list for this request. Its first entry is $m_{sys}$, the system entry, written once when the conversation is configured. Everything after it is $m_1, m_2, \ldots, m_T$: the alternating user and assistant turns, where $T$ counts how many turns exist so far. Same words in $m_{sys}$ carry more weight than the same words in a user turn, because providers tune their models to treat the system slot as higher priority instruction.

A separate slot with more weight

Most chat APIs mark that first entry with role: "system", ahead of the role: "user" and role: "assistant" entries. That label is the whole trick. Two identical sentences land differently depending on the slot: one is a fact somebody mentioned, the other is a rule the model was tuned to keep obeying. You are not just writing earlier in the prompt. You are writing in the slot the model was trained to respect.

This is also why moving persona text into each user turn is weaker, not stronger. Pasted reminders arrive in the ordinary slot, diluted among the questions, and they cost tokens every time for a job the system slot already does.

It persists on every call, and it dilutes

Every request resends the full history, system entry included, and all of it counts against the same context budget. Write $S$ for the system tokens (the length of $m_{sys}$), $N$ for the tokens each turn adds on average, and $C_T$ for the conversation tokens after $T$ turns, so $C_T = T \times N$. The share of the prompt that is still your standing instruction is:

That fraction is the trade-off in one line. Setting the persona once buys consistency for free across early turns, and it costs tokens on every call while shrinking in influence as $T$ grows. Small $S$ with sharp rules beats long $S$ with essays: every extra system token is rent paid on all future calls.

Worked example: from 23 percent to 4 percent

Take a 120 token system block, so $S = 120$, and turns averaging $N = 400$ tokens each.

After the first user turn, $T = 1$ and $C_1 = 400$. The request totals $120 + 400 = 520$ tokens, and the system share is $120 / 520 \approx 0.231$, about 23 percent. The rules are nearly a quarter of everything the model reads. They dominate.

After eight turns, $T = 8$ and $C_8 = 8 \times 400 = 3200$. The request totals $120 + 3200 = 3320$ tokens, and the share is $120 / 3320 \approx 0.036$, about 4 percent. Same 120 tokens, same wording, now a whisper under half a percent times ten. That is exactly when you notice the drift: hedges creep back, the snippet stops coming first, the assistant starts explaining things you never asked about. Nothing was deleted. It was outnumbered.

Instruction is not enforcement

Here is the assumption people get wrong. The system slot rests on tuning: the model was trained to prioritise it, and it usually does. But a user turn that pushes hard enough, a clever rephrase or a claimed exception, works against a strong preference, not a wall the model cannot cross. That is why jailbreaking works at all, and why anything load bearing, a permission check, a content filter, a secret that must never leak, belongs in code around the model rather than only in its instructions. Do not use a system prompt where you need a guarantee. Use it where you need a default that holds under normal pressure and fails loudly, through your own checks, under hostile pressure.

Code

The point of this snippet is the dilution curve from the worked example: the same 120 tokens, measured at turn one and turn eight.

1def system_share(system_tokens: int, turns: int, per_turn: int) -> float:2    return system_tokens / (system_tokens + turns * per_turn)3
4
5print(f"{system_share(120, 1, 400):.1%}")  # -> 23.1%6print(f"{system_share(120, 8, 400):.1%}")  # -> 3.6%

The outputs match the hand computation above: about 23 percent early, under 4 percent late. When your assistant starts drifting in long sessions, this fraction is the first number to check before you blame the model or rewrite the persona.

Watch Out For

The Quick Version

• A system prompt is written once into a separate system slot ahead of the chat, and the model is tuned to weight that slot as standing instruction, not ordinary context.
• It persists without being repeated, but it still costs tokens on every call and shrinks as a share of a growing prompt, from about 23 percent to under 4 percent in the worked example.
• Keep it short: persona plus a few hard rules. Examples and session detail belong in turns or retrieved context, not in rent paid on every call.
• It shapes behaviour under normal pressure but does not enforce anything. A rule that must hold needs a check outside the model.
• When a long session drifts, check the system share before rewriting the persona. Usually nothing was deleted; it was outnumbered.

What to Read Next

• Context Windows
• Context Engineering
• Guardrails
• Jailbreaking