System Prompt Lock

An agent's system prompt is what tells it who it is and what it may do. Normally the agent's own code supplies it — which means anything that can reach the agent can try to change it. A prompt injection hidden in a document, a poisoned tool result, or simply a bad deploy can all rewrite what an agent believes its job is.

A system prompt lock moves that instruction out of the agent and onto the Agent Persona. The gateway then sends the approved prompt on every model call, so the agent's role is set by you rather than by whatever last spoke to it.

Quick Start: What do you want to do?

I want to...	Go to
Lock an agent's instructions	Lock a persona's prompt
Decide what happens to the agent's own prompt	Choose how to handle the agent's own prompt
Watch the effect before enforcing	Monitor before you enforce
Write a good prompt	What makes a good approved prompt
Know which providers it covers	Which model calls it covers

---

Lock a persona's prompt

1. Open the persona from Agent Personas.
2. Go to Configuration → Policy → System Prompt Lock.
3. Select Lock system prompt.
4. Review the Approved system prompt. It is pre-filled from the persona's job description if it has one.
5. Choose what happens if the agent sends its own prompt.
6. Leave it on Monitor to start with.
7. Select Save & deploy.

Until you save, nothing has changed — the lock is staged with the rest of your persona edits.

Before it is configured, the section reads The agent chooses its own instructions. Once saved you will see a chip next to the heading showing either Monitoring or Enforced, so the state is visible at a glance. The persona's Overview tab also shows System Prompt Lock as locked or not.

Choose how to handle the agent's own prompt

Agents often send a system prompt of their own. You decide what the gateway does with it.

Option	What happens	Choose it when
Block the request	The call is refused with a clear error	The agent was never meant to set its own instructions. This is the default and the safest choice.
Replace it	The agent keeps working; its instructions are dropped and yours are used	You want the agent to keep running, and its own prompt is noise rather than need
Keep it second	Your approved prompt goes first, the agent's follows	The agent genuinely needs to add its own context, such as the current user or task

If the agent sends exactly the approved prompt, the request is treated as compliant and passes through untouched whichever option you pick.

Monitor before you enforce

The lock has two modes, and they are independent of everything else on the persona.

Mode	Effect
Monitor	Nothing changes. Calls go through as they always did, and any call where the agent sent its own prompt is recorded so you can see the impact.
Enforce	The rule you chose above is applied to every model call this persona makes.

Start in Monitor. Agents that send their own system prompt are common and not always obvious from the outside, and Monitor tells you which ones do before anything starts failing. When the recorded calls look the way you expect, switch to Enforce.

What makes a good approved prompt

The portal scores the prompt against five checks and shows the result as Prompt check. All five are worth passing:

Check	What it is looking for
States the agent's role	The prompt says what this agent is
Sets a scope	It says what the agent works on
Says what to refuse	It tells the agent to decline things outside that scope
Treats tool output as data	It tells the agent not to follow instructions found inside documents, emails or tool results
No credentials in the prompt	No keys, tokens or passwords are pasted into it

The first four are warnings with a one-select fix that appends a suitable sentence. The credentials check is an error — a system prompt is not a safe place to put a secret, and the agent will happily repeat one.

If you would rather not start from scratch, Start from offers the persona's own job description plus templates for a customer support, internal knowledge, or coding assistant.

The prompt can be up to 20,000 characters, with a counter below the field.

Which model calls it covers

The lock applies to the persona's generation calls — the ones that ask a model to produce an answer. It covers the Anthropic Messages API, the OpenAI Chat Completions API, and the OpenAI Responses API.

caution

An enforced lock will refuse a generation call made on a provider format the gateway cannot read the system prompt from, including the native Amazon Bedrock and native Google Gemini formats. The gateway will not let a call through unchecked when you have asked for the prompt to be enforced.

If a persona uses one of those formats, keep the lock on Monitor, or point the agent at one of the supported formats. The LLM Registry guides show which format each client uses.

Calls that are not generation — listing models, embeddings, file operations — are not affected.

Under Block the request and Replace it, the gateway also refuses calls that pull in conversation context it cannot see, such as a stored prompt template or a reference to a previous response. That hidden context could carry instructions the lock was meant to catch.

What a blocked caller gets

A refused call returns 403, formatted as an error from whichever AI provider the agent was calling, so existing error handling understands it. The message tells the agent its system prompt is set by policy and that it should remove its own.

The response is marked as not worth retrying, so a well-behaved client will not loop.

Real-world examples

An accounts-payable agent that must never approve payments

Setting	Value
Approved prompt	States the role, limits it to invoice and payment-status questions, refuses anything else, and says never to approve a payment
If the agent sends its own	Block the request
Enforcement	Enforce

A support assistant that needs per-conversation context

Setting	Value
Approved prompt	States the support role, the products in scope, and that tool output is data
If the agent sends its own	Keep it second
Enforcement	Enforce

The approved prompt always leads, so the agent can add the customer's details without being able to change its own role.

Tips

• Tell the agent to treat tool output as data. This is the single most valuable line in the prompt. Most injection attempts arrive inside something the agent reads, not in what the user typed.
• Monitor first, always. Enforcing straight away on a busy persona is how you find out the hard way which agents send their own prompt.
• Never put a credential in the prompt. The check will flag it, and an agent asked nicely will repeat it back.
• Say what to refuse, not just what to do. An agent with no stated boundary tends to try to be helpful outside it.
• Re-read the prompt when the persona's tools change. A prompt that scoped an agent to three tools is stale once it has eight.