System messages dominate the OpenAI instruction hierarchy. They sit at the top, above developer constraints and user requests.
For AI agents, this precedence dictates how conflicts are handled. The system role defines the high-level behavior and safety boundaries. Models are trained to follow these rules. They cannot ignore them just because a user asks them to. When roles clash, the assistant defers to the system message.
Tool use depends on this structure. The API provides the schema for functions, but the system prompt decides when to use them. Without clear, imperative instructions in the system message, models often prefer text reasoning over tool calls. They miss the trigger conditions.
Architectural patterns rely on this separation. The Manager-Specialist pattern uses a central manager to invoke specialists as tools. Structured contracts ensure typed, schema-based validation at runtime. Security requires keeping system messages safe. Never inject untrusted user input directly into them. Use structured outputs to prevent injection attacks.
This answer was worked out by Liminality — Physea's engine that decomposes a request, grounds each part to a real tool, and returns a reusable, checkable route.
Connect it over MCP: https://mcp.physea.ai/mcp · physea.ai