It's usually written by the company behind the product and loaded automatically each time, so you rarely see it.
A typical system prompt sets out who the assistant is, the tone to use, how to format answers, what to decline and which tools it has. It works like the house rules a new starter is given on day one: nobody repeats them in every meeting, but they shape every piece of work.
What does a system prompt change?
It explains a lot of behaviour that otherwise looks random. When a product refuses a harmless request, answers stiffly or adds a disclaimer to everything, the system prompt is often the reason. The model is following instructions you can't see.
It's also why two products using the same model can feel so different. One has been told to be brief and cautious, the other to be expansive and chatty. OpenAI's prompt engineering guide describes how developers give these higher-priority instructions to a model.
An example
You ask a general chat app and a legal research tool what a limitation-of-liability clause means.
The chat app gives a broad, friendly explanation. The legal tool answers more narrowly, quotes the wording back to you and suggests confirming the point with a solicitor. Both might run a similar model; each was given different standing instructions.
Can you write your own system prompt?
Partly, in many products. Features such as ChatGPT's custom instructions and Claude's project instructions let you add standing guidance that applies to every conversation, on top of the provider's own.
In a personal AI agent, much more of it can be yours: who you are, how you write, your rules and your exceptions. That's a large part of why a well-configured agent feels as if it knows how you work. Our comparison of custom GPTs, Claude Projects and a personal agent shows how far each one goes.
Common questions
Can I see a product's system prompt?
Usually not, if the product is closed. Some tools let you inspect or edit it, especially when you're building or configuring your own agent. Where you can't see it, you can still infer a lot from how the product behaves.
Can a system prompt be overridden?
It can be argued with, and sometimes text the model reads (a web page, a document, an email) contains instructions that pull it off course. That's called prompt injection, and it's why it's treated as a security problem and not a curiosity.
Does a system prompt make an AI model safe?
It helps, but instructions alone aren't a security control. Safety depends on limiting what the system can reach and do, with checks the model can't talk its way past. Those limits are covered under AI guardrails.