Set-and-Forget System Prompt

also known as Instruction Drift, Turn-Zero-Only Policy, System-Prompt Attention Decay

Anti-pattern: state the agent's role and policy once in the turn-zero system prompt and assume it keeps binding, when attention to that block decays over turns while its text sits unchanged in context.

Context

An agent is configured by writing its role, its constraints and its operating policy into a system prompt that is sent once, before the first user turn. Everything after that — user messages, model replies, tool calls and their results — is appended to the same window. The block is never edited, never summarised and never falls out of the window, so an operator inspecting the running conversation finds the policy exactly as it was written. The same shape appears outside dialogue, where a repository instruction file states standing conventions that a coding agent is expected to honour for the length of an autonomous run.

Problem

Presence is not the same as force. Attention to a fixed opening block thins as the history in front of it grows, so the instruction stops steering the model long before it stops being readable. A quantitative benchmark of multi-turn dialogs reports significant instruction drift within eight rounds for LLaMA2-chat-70B and GPT-3.5, attributed to attention decay over dialogue length. The same non-bindingness is measured for passive instruction files: on SWE-bench Lite a documented constraint is honoured 67.0% of the time, and asking the model to reflect over that same text is worse at 50.3%, while compiling the constraint into an executable check reaches 88.3%. That reflection scores below the plain baseline is the clearest sign the failure is architectural rather than a wording problem. The taxonomy of multi-agent failures puts the two resulting modes at the very top of its list: disobeying the task specification and disobeying the role specification.

Forces

A single opening block is cheap to write and free to carry, while re-asserting the policy on every turn costs tokens and breaks the cached prefix, so the default architecture is exactly the one that drifts.
Presence in the window is trivial to audit and binding force is not, so a check that the policy text is still there returns green while behaviour has already reverted to generic.
Attention is finite and spreads across a lengthening history, so the opening block competes with more recent tokens every turn no matter how emphatically it is phrased.
The cheapest available remedy — asking the model to re-read its own standing instructions — measures worse than doing nothing extra, at 50.3% compliance against a 67.0% baseline.
Evaluation is usually run on short exchanges, so the configuration is signed off at the turn where it still binds and never measured at the turn where it does not.

When to watch for it

Watch for this in any agent whose role, constraints or policy are stated once in a system prompt and never restated.
Suspect it when behaviour is correct early in a session and reverts to generic later, with the prompt text unchanged.
Audit for it when standing conventions live in an instruction file that a long autonomous run is trusted to honour without any check.
Cite this entry when a fix attempt consists of rewording the opening block and the drift returns at the same turn depth.

When it is not a concern

Interactions are short enough that the conversation never reaches the depth at which the opening block stops binding.
The standing policy block is already recomputed and re-injected verbatim on every turn, which is the corrective rather than the anti-pattern.
Every load-bearing constraint is enforced by a deterministic check outside the model, so the prompt wording is advisory rather than binding.
The problem is that the summariser rewrote the rule or that the prompt grew unmanageably, which are the neighbouring anti-patterns rather than this one.

Example

A support agent is configured with a system prompt saying it must never quote a price and must hand every billing question to a human. For the first few exchanges it does exactly that. Twenty turns into a long troubleshooting conversation the customer asks what the upgrade costs, and the agent answers with a figure. The instruction is still in the prompt, word for word, and nothing summarised, edited or evicted it.

Diagram

flowchart TD S["Turn-zero system prompt: role, constraints, policy"] --> T1["Turn 1 — block dominates attention"] T1 --> T8["Turn 8+ — history grows, attention to the block thins"] T8 --> D{"Is the text still present?"} D -- "yes, verbatim" --> A["Audit passes"] D -- "but no longer steering" --> V["Role reverts, constraint silently violated"] V --> C1["Corrective: re-inject the block verbatim each turn"] V --> C2["Corrective: compile the constraint into an executable check"] C1 --> M["Measure compliance by turn index, not at turn one"] C2 --> M

Solution

Therefore:

The corrective splits into two families, and serious deployments use both. The first is re-assertion: the prompt-assembly step recomputes and re-injects the role and policy block verbatim on every turn, placed late in the prompt rather than at position zero, so its weight does not depend on how far the conversation has run; attention-level remedies such as split-softmax do the same job inside the model. The second is externalisation: the constraint is compiled into something that executes — a static check, a runtime shim, or a validator that intercepts an action before it lands — so a violation is caught by a mechanism that has no attention budget to lose. Whichever family is chosen, compliance is measured as a function of turn index and run length rather than at the opening turn, because a configuration that binds at turn one and not at turn twenty passes every short evaluation.

What it gives you

Naming the failure separates two things operators conflate: an instruction being present in the context versus an instruction still governing behaviour.
It gives a measurable target — compliance by turn index — where the usual evaluation reports only turn-one adherence.
It points at the two correctives that are known to work, per-turn re-injection and external enforcement, and away from the reflection remedy that measures worse than the baseline.

What it costs you

An agent passes its configuration review on short exchanges and then reverts to generic behaviour inside eight rounds of ordinary dialogue, with no error raised and no trace anomaly to inspect.
A third of documented constraints go silently unhonoured in long autonomous runs, and in settings without real-time supervision those violations compound into rework.
The correctives are not free: re-injecting the block every turn spends context budget and invalidates the cached prefix, and externalising a constraint requires expressing it in something executable.
Debugging misfires, because the policy text is intact and readable, so effort goes into rewording a block whose wording was never the problem.

What this pattern forbids. A standing role or policy constraint must not rest on a single turn-zero block: it has to be re-injected verbatim on each turn or enforced by a check outside the model, and compliance can never be signed off from opening-turn behaviour alone.

The patterns that counter or replace it —

alternative-toGuardrail Erosion Through Compaction✕— Anti-pattern: each compaction pass rewrites the running history, so a hard safety instruction is gradually paraphrased into vague advice and its force decays the longer the agent runs.
alternative-toStanding State Injection★— Recompute a compact task-state snapshot each turn and inject it as a fresh system block before the model reasons, so a long tool-call loop stays oriented on the goal.
alternative-toConstitutional Charter★— Define rules the agent reads every turn but cannot modify, encoding inviolable boundaries.
alternative-toPolicy-as-Code Gate★— Evaluate every proposed agent action against externally-managed machine-readable policies before dispatch, so compliance authorship lives outside the prompt and outside the agent code.
complementsAttentive Reasoning Queries★— Replace free-form chain-of-thought with a domain-tailored sequence of structured queries that re-anchor the model's attention to the critical instructions and prior decisions at the exact generation steps where adherence tends to slip.
complementsLost in the Middle (Positional Bias)✕— LLM accuracy on retrieving information from long contexts drops sharply when relevant content sits in the middle of the prompt rather than at the start or end.
complementsContext Window Dumb-Zone Cap★— Hold context-window utilization below a working threshold (~40%) to keep the model out of the 'dumb zone' where it begins ignoring earlier instructions and hallucinating.
complementsPrompt Bloat✕— Anti-pattern: every bug fix adds a sentence to the system prompt; nothing is ever removed.
complementsRogue Agent Drift✕— Anti-pattern: deploy a long-running agent with persistent memory and self-modification ability, then leave it without periodic re-alignment to its stated purpose.
complementsContext-Driven Architecture Drift✕— Anti-pattern: let a coding agent change a brownfield codebase guided only by the files it can see, so it silently violates the architecture conventions that live in nobody's machine-readable form.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance

Source: patterns/set-and-forget-system-prompt.md on GitHub · commit 804ea97 · view history
Added to catalog: 2026-09-09
Last updated: 2026-09-09
Contribute: open an issue or PR at github.com/agentpatternscatalog/patterns.