System prompts that survive a regulated rollout

A system prompt is the operating brief for a model: who it is, who it serves, what it may and may not do, how it sounds, how it refuses, when it escalates, what format it returns, and how to use its tools. In a regulated rollout that brief stops being a developer's text file and becomes a contractual artefact: compliance signs the scope, legal signs the disclaimers, model risk signs the refusal behaviour. So treat it like code and like a contract at once. Write it as numbered clauses in labelled sections. Compose it from layers with a stated precedence (platform policy first, then tenant, then use case, then session context), keep static layers first so caching works, and inject session values only after validation. Test the rendered text in CI for required clauses, placeholders and anti-patterns, and test behaviour with probes that try to push the persona off scope. Remember what a prompt is not: it is not an access control and it is not a secret.

• Numbered clauses make a persona auditable. Every clause maps to an owner and a test.
• Layers with explicit precedence stop tenant or user text overriding platform policy.
• Static first, dynamic last. Caching, auditing and diffing all depend on it.
• Refusals are designed, not improvised: short, helpful, consistent across languages.
• Prompts guide behaviour; code enforces it. Permissions, secrets and consequential actions live outside the prompt.