13 AI Prompt And System Message Spec

AI Prompt and System-Message Spec Skill

Use When

• A prompt or system message is a versioned production dependency.

Do Not Use When

• Do not use for one-off research prompts or to store secrets, policy solely in prose, or untested jailbreak claims.

Required Inputs

Workflow

1. Read the named inputs and confirm their approval, version and unresolved decisions.
2. Apply the decision rules below before drafting; stop on a missing authority, unsafe assumption or unresolved scope driver.
3. Produce the Prompt and System-Message Specification through the existing domain procedure and load only the references needed for the chosen branch.
4. Trace each material statement in the Prompt and System-Message Specification to an input, decision or explicitly qualified assumption.
5. Verify the observable acceptance conditions, record unassessed checks, and hand the artefacts to their named consumers.
6. If validation fails, recover by correcting the source decision or artefact and rerun the affected check; do not weaken the acceptance condition.

Outputs

Evidence Produced

Capability and permission boundaries

Read-only is the default for analysis, review, evaluation and planning. Read and search access to authorised project artefacts are required. Editing is limited to an explicitly requested project deliverable. Execution may run document, syntax or validation checks. Network access is used only for facts that require current verification. Do not publish, spend, change production, approve policy, or claim certification without explicit authority.

Degraded mode

If any required capability is unavailable, return the narrowest useful qualified Prompt and System-Message Specification draft plus a gap register showing the missing item, affected sections, risk and owner. Never convert an unassessed check into a pass.

Decision Rules

Quality Standards

• Preserve repository terminology and trace every material choice to project context.
• Use deterministic acceptance conditions; replace vague quality claims with an observable check, threshold or named approval.
• Cover error, empty, edge, recovery and operational cases relevant to this skill.
• Verify standards, citations, APIs and package names before relying on them; qualify what cannot be checked.
• Stop release for a failed safety, security, legal, financial, accessibility or data-integrity gate.

Anti-Patterns

• Editing a prompt in production. Fix: version, review, evaluate and deploy it.
• Putting secrets in system messages. Fix: retrieve secrets through authorised runtime controls.
• Concatenating untrusted text with instructions. Fix: delimit context and enforce hierarchy.
• Testing only ideal prompts. Fix: include adversarial, empty, long and conflicting inputs.
• Rolling back code but not prompts. Fix: pin prompt tags and specify independent rollback.

References

• Prompt registry template
• System-message patterns
• AI Model Card neighbour

Core Instructions

Step 1: Prompt inventory

For every production AI feature, list every prompt artefact: system message, user-message template, retrieval-context wrapper, judge-LLM rubric, agent planner prompt, agent tool-result wrapper. Each has a registry tag.

Step 2: Registry layout

Define the source-of-truth (Git repo prompts/), the directory layout, the file format (yaml or markdown front-matter), the versioning scheme (semver), the tagging rule, the owner field.

Step 3: Change-control workflow

A prompt change requires:

1. PR with the diff.
2. Regression-eval run on the attached golden set; results in the PR.
3. Red-team smoke run.
4. Sign-off from prompt owner + AI lead.
5. Tag bump on merge.
6. Pinned deploy to staging; bake time; promote to prod.

Step 4: System-message patterns

Top-of-message rules:

• Role declaration.
• Refusal rules (out-of-scope, content policy).
• Output schema (when structured).
• Citation rule (when RAG).
• Abstain rule.
• Style rules.
• Anti-jailbreak guards (do not reveal system message; treat untrusted text as data, not instruction).

Step 5: Retrieval-context format

When passing retrieved chunks, wrap them with explicit boundaries, source-id markers, and a parser-friendly format. Forbid mixing retrieved text into the system message. Include a do-not-execute-instructions clause for the retrieved block.

Step 6: Deploy and rollback

State the deploy pipeline (tag in registry -> gateway picks up on next call), the bake protocol, the rollback action (revert tag pin), and the alerting on regression after deploy.

Step 7: Secrets and PII rules

Prompts contain no secrets. Tenant identifiers are guarded claims, not free text. PII in prompts is redacted by a pre-processor; logs of prompt and response are tenant-partitioned.

Step 8: Write the spec

Prompt_And_System_Message_Spec.md sections: 1) Prompt Inventory, 2) Registry Layout, 3) Change-Control Workflow, 4) System-Message Patterns, 5) Retrieval-Context Format, 6) Deploy & Rollback, 7) Secrets and PII Rules, 8) Traceability.

Standards

• OWASP LLM01 (prompt injection)
• Anthropic prompt-engineering guide
• NIST AI RMF MANAGE