Gemini System Instructions: Consistency, Not Security
Gemini system instructions are processed before user prompts and can guide role, tone, context, rules, and output format across an interaction. They improve consistency, but they cannot guarantee factuality, prevent prompt injection, or safely hold secrets.
What system instructions control
Role and persona
Define the perspective, audience, expertise level, and communication style the assistant should use.
Goals and rules
State persistent priorities, boundaries, escalation behavior, and how uncertainty should be represented.
Output format
Request stable headings, Markdown conventions, field names, or response structure across multiple user turns.
Shared context
Provide durable domain definitions or workflow context that applies to the interaction, without embedding secrets.
Separate persistent policy from the user task
Place stable behavior in the system instruction and the current request in the user message. This makes prompts easier to maintain and reduces accidental mixing of application policy with user-provided data.
- Define role, audience, tone, goals, and output conventions once.
- Keep request-specific source material and questions in the user message.
- Make priority conflicts explicit and test how the model handles ambiguous instructions.
Write operational instructions
Useful instructions describe observable behavior. Tell the model how to handle missing evidence, conflicting sources, unsupported requests, and required output—not just that it should be helpful or accurate.
- Require the response to distinguish verified facts from assumptions.
- Define when to ask a clarifying question or decline to guess.
- Specify exact fields or headings when downstream consumers expect them.
Apply instructions through the API
The Google Gen AI SDK accepts a system instruction in generation configuration. Keep the model identifier and instruction text versioned in application configuration, then evaluate changes before deployment.
- Use the official SDK and server-side environment variables for credentials.
- Record a prompt version in logs without recording sensitive prompt content.
- Confirm SDK syntax and model compatibility in current official documentation.
Understand security limits
System instructions influence the model; they do not enforce authorization. Google notes they help guide behavior but do not fully prevent jailbreaks or leaks, so sensitive data and security decisions must stay outside prompts.
- Never store API keys, passwords, private policies, or user secrets in system instructions.
- Treat user content, retrieved pages, and documents as possible prompt-injection sources.
- Enforce tool permissions, data access, and business rules in deterministic application code.
Test consistency and failure modes
Evaluate system instructions with ordinary requests, boundary cases, malicious overrides, multilingual prompts, and long conversations. Measure both compliance and whether the instruction harms useful answers.
- Test attempts to reveal, replace, or contradict the system instruction.
- Check format compliance, refusal quality, factuality, and escalation behavior.
- Retest whenever the instruction, model, tools, or retrieval sources change.
Python
This example defines role, evidence handling, and format separately from the user request. Set GEMINI_MODEL to a currently supported model.
import os
from google import genai
from google.genai import types
client = genai.Client()
model = os.environ["GEMINI_MODEL"]
config = types.GenerateContentConfig(
system_instruction=(
"You are a concise API documentation assistant. "
"Separate verified facts from assumptions. "
"Return Markdown with short headings."
)
)
response = client.models.generate_content(
model=model,
contents="Explain how request retries should be designed.",
config=config,
)
print(response.text)