What is System Prompt?

Where a user message is one request, the system prompt is the frame around all of them: you are a support agent for Acme; never quote prices; if you don't know, say so; answer in British English. It sits at the top of the context on every call, which is why it's both powerful and expensive — it's re-sent each turn and competes with everything else for room. Good ones are specific and few: a rule the model follows 60 per cent of the time is worse than no rule, because you'll trust it.

The critical caveat is that a system prompt is not a security boundary. It's text the model weighs, and injected instructions in a document or email can outweigh it — which is why never delete without asking belongs in the runtime, not the prompt. Velaris enforces that where it can't be argued with: destructive-tier tools require human approval regardless of what the model has concluded, and credentials are scoped per run. The system prompt shapes behaviour; tiers and tokens decide what's permitted.