Instruction Hierarchy & System Prompt

Instruction Hierarchy is a formal security architecture and prompt design framework that establishes strict privilege tiers across conflicting inputs; it establishes 3 distinct privilege levels: 1) System Instructions (Developer Messages: absolute highest authority defining identity, guardrails, and non-negotiable formats); 2) User Prompts (medium authority expressing user intent, strictly subordinate to system constraints); 3) Untrusted Third-party Context (Retrieved RAG passages, web snippets, tool outputs: zero privilege, strictly evaluated as passive data payload).

Production System Prompt engineering, defending against Indirect Prompt Injection lurking within RAG documents or tool payloads.

Flat prompt contexts treat all text tokens with equal authority, allowing adversarial strings like 'Ignore all previous instructions' to hijack execution; Instruction Hierarchy hardens top-level system commands against override attempts.

How do OpenAI and Anthropic train models during RLHF/SFT to enforce role priority boundaries across `system`, `user`, and `tool` roles?

What is the standard modular architecture for writing production System Prompts (persona, workflow, format, guardrails)?

How does strict XML tagging (`<context>...</context>`) physically demarcate retrieved passages as non-executable read-only payload?

What is the arbitration and refusal protocol when user instructions directly contradict hard system prompt constraints?

How to prevent System Prompt attention decay and forgetting across massive 100K+ token conversational contexts?