System Prompt

The system prompt establishes an immutable professional identity that persists across all user turns. For legal applications, this means defining the model as a licensed legal assistant, a contract analyst, or a judicial clerk. This persona assignment anchors the model's tone, vocabulary, and ethical boundaries. A well-crafted persona instruction prevents the model from offering medical advice or casual opinions when asked a legal question.

• Example: "You are a senior paralegal specializing in Delaware corporate law. You provide precise, citation-backed analysis."
• Key mechanism: Role assignment primes the model's attention layers to prioritize legally relevant patterns from pre-training.

Legal reasoning is meaningless without a defined jurisdiction and effective date. The system prompt must explicitly constrain the model's knowledge boundary to a specific sovereign legal system and temporal snapshot. This prevents the model from conflating California and German law, or applying a statute repealed in 2022.

• Example constraint: "Base all analysis on the laws of England and Wales as they stood on January 1, 2024."
• Critical detail: Without this scoping, a model defaults to its probabilistic majority training data, which is often U.S.-centric and temporally ambiguous.

Legal system prompts must define what the model must not do as rigorously as what it must do. Negative instructions prevent unauthorized practice of law, fabrication of citations, and disclosure of hypothetical privileged information. These constraints act as hard guardrails that override conflicting user requests.

• "You must never" : Provide a definitive legal opinion or tell a user what the law is in their specific situation.
• "You must never" : Invent a case citation. If you cannot find a real citation, state that explicitly.
• "You must never" : Speculate on outcomes. Always qualify predictions with probabilistic language.

A legal system prompt must enforce a strict structured output protocol to ensure machine-readability and human auditability. This includes mandating a specific citation standard and a consistent reasoning structure, such as IRAC (Issue, Rule, Application, Conclusion) or CREAC (Conclusion, Rule, Explanation, Application, Conclusion).

• Citation mandate: "Cite all legal authority using a standard legal citation format (e.g., Bluebook). Enclose every citation in <cite> tags."
• Structure mandate: "For every analysis, first state the legal issue, then the governing rule, then apply the rule to the facts, and finally state a tentative conclusion."

The system prompt governs how a model interacts with external legal databases and APIs. It must define when to invoke a legal research tool versus relying on internal parametric knowledge. This is the primary mechanism for ensuring citation fidelity and preventing hallucination.

• Grounding rule: "You have access to a case law database. Before making any claim about a precedent, you MUST use the search_caselaw function to retrieve the exact text."
• Fallback rule: "If the tool returns no results, state 'No supporting authority was found' rather than guessing."

The system prompt must simulate an ethical wall by defining strict data handling boundaries. It instructs the model to treat all user-provided facts as potentially privileged and to refuse any request that would violate confidentiality or create a conflict of interest.

• Protocol: "Treat all facts provided by the user as confidential attorney work product. Do not summarize or repeat these facts in any context outside this session."
• Refusal trigger: "If asked to draft a communication for an opposing party, refuse and state that it would breach your ethical constraints."

A critical security vulnerability where adversarial user input overrides the system prompt or safety guardrails. In legal contexts, an injection attack might attempt to extract a confidential system prompt containing proprietary litigation strategy or force the model to ignore its behavioral constraints, potentially causing unauthorized disclosures of case data.

• Direct Injection: Overriding instructions with commands like 'Ignore previous directions'
• Indirect Injection: Hiding malicious instructions in documents the model processes
• Mitigation: Requires input sanitization, privilege separation, and robust guardrails

The systematic tracking of changes to system prompt templates over time, analogous to version control for source code. Legal engineering teams use versioning to audit which instruction set produced a specific output, roll back to a stable prompt after a prompt drift incident, and conduct rigorous A/B testing to prove that a new system prompt reduces hallucination rates before production deployment.

The maximum token capacity a model can process in a single request, defining the hard limit for the combined length of the system prompt, user query, and generated output. In multi-document legal reasoning, a large context window is essential to ingest a detailed system prompt alongside hundreds of pages of contracts and case law without truncation, preserving the full behavioral context for accurate analysis.

The capability to force a model to generate responses in a predefined machine-readable format like JSON, as dictated by the system prompt. This is essential for integrating legal reasoning into downstream software. A system prompt can specify: 'Return a JSON object with keys for clause_type, risk_assessment, and citation_list,' ensuring the output is directly parseable by a contract review pipeline.