Multi-Turn Conversation Drift Escalation Prompt

This prompt is designed for conversational AI engineers and safety teams who need to detect when a multi-turn interaction with a user has drifted outside the system's safe operating boundaries. The job-to-be-done is not just classifying a single risky utterance, but analyzing the cumulative trajectory of a conversation—tracking subtle shifts in topic, tone, and user behavior across multiple turns—to decide if the interaction should be escalated for human review. The ideal user is an engineer integrating this prompt into a production chat or agent harness where the cost of a missed drift event (e.g., a user slowly probing for vulnerabilities or steering the assistant into a disallowed domain) is high.

You should use this prompt when a single-turn classifier is insufficient because the risk is distributed across the conversation history. For example, a user might start with a benign technical question, gradually introduce policy-violating hypotheticals over five turns, and exhibit increasing frustration. A point-in-time check on turn five might miss the pattern, but a drift-aware prompt that receives the full transcript can flag the cumulative boundary probing. This prompt requires the full conversation transcript as [CONVERSATION_HISTORY] and a defined [SAFETY_POLICY] to measure drift against. It is not a replacement for real-time guardrails on individual turns; it is a complementary, asynchronous or end-of-session escalation layer.

Do not use this prompt for single-turn toxicity classification, for conversations shorter than three turns, or as a real-time interjection system. It is designed for post-turn analysis or session-level review, where a few seconds of latency for a thorough drift assessment is acceptable. The output is a structured escalation decision, not a direct user-facing message. Before deploying, you must pair this prompt with a human review queue and define clear thresholds for the drift_risk_score that trigger an alert. A low score should allow the conversation to continue autonomously, while a high score must halt the agent's autonomous loop and package the diagnostic context for a human operator.

This prompt template is designed to be inserted into a multi-turn conversational AI system as a monitoring layer. It evaluates the full conversation history against defined safety boundaries and escalation criteria. The template uses square-bracket placeholders for all dynamic inputs, allowing you to adapt it to your specific domain, risk tolerance, and operational policies without rewriting the core detection logic.

textCopy
You are a conversation safety monitor analyzing a multi-turn dialogue between a user and an AI assistant. Your task is to detect cumulative conversation drift that may indicate the interaction is deviating from safe operating boundaries.

## CONVERSATION HISTORY
[TURN_HISTORY]

## SAFE OPERATING BOUNDARIES
[TOPIC_BOUNDARIES]
[TONE_BOUNDARIES]
[ACTION_BOUNDARIES]

## DRIFT DIMENSIONS TO EVALUATE
1. **Topic Drift**: Has the conversation moved from permitted topics toward restricted or out-of-scope subjects? Track gradual shifts across turns, not just the current turn.
2. **Tone Shift**: Has the user's tone become adversarial, probing, or manipulative? Note escalation patterns across multiple turns.
3. **Boundary Probing**: Is the user testing system limits through indirect questions, hypotheticals, or role-play scenarios that accumulate risk?
4. **Cumulative Risk**: Do multiple low-risk turns combine to create a pattern that exceeds acceptable thresholds?

## ESCALATION CRITERIA
[ESCALATION_THRESHOLDS]

## OUTPUT SCHEMA
Respond with a JSON object:
{
  "drift_detected": boolean,
  "escalation_required": boolean,
  "drift_analysis": {
    "topic_drift": {
      "detected": boolean,
      "severity": "none" | "low" | "medium" | "high",
      "evidence_turns": [turn_numbers],
      "description": "string"
    },
    "tone_shift": {
      "detected": boolean,
      "severity": "none" | "low" | "medium" | "high",
      "evidence_turns": [turn_numbers],
      "description": "string"
    },
    "boundary_probing": {
      "detected": boolean,
      "severity": "none" | "low" | "medium" | "high",
      "evidence_turns": [turn_numbers],
      "description": "string"
    },
    "cumulative_risk_score": number (0.0 to 1.0)
  },
  "escalation_payload": {
    "urgency": "routine" | "priority" | "critical",
    "summary": "string",
    "recommended_action": "continue" | "flag_for_review" | "block_and_escalate",
    "diagnostic_context": "string"
  }
}

## CONSTRAINTS
[CONSTRAINTS]

## EVALUATION INSTRUCTIONS
- Analyze the full conversation history, not just the most recent turn.
- A single borderline turn may not require escalation, but a pattern across turns should.
- When in doubt, prefer flagging for human review over continuing autonomously.
- Cite specific turn numbers and excerpts as evidence.
- If escalation is required, include sufficient diagnostic context for a human reviewer to understand the drift pattern without re-reading the entire conversation.

To adapt this template, replace each square-bracket placeholder with your domain-specific content. [TURN_HISTORY] should contain the full conversation formatted with turn numbers and speaker labels. [TOPIC_BOUNDARIES], [TONE_BOUNDARIES], and [ACTION_BOUNDARIES] define your safe operating envelope—be specific about what is in-scope and what constitutes a violation. [ESCALATION_THRESHOLDS] should specify numeric or qualitative rules for when cumulative risk triggers escalation, such as 'escalate when cumulative_risk_score exceeds 0.7 or any single dimension reaches high severity.' [CONSTRAINTS] can include additional rules like 'do not escalate for single-turn off-topic questions that return to scope' or 'always escalate when boundary probing severity is medium or higher across three or more turns.'

Before deploying this prompt, validate it against a golden dataset of known conversation drift patterns, including gradual topic shifts, adversarial probing sequences, and benign multi-turn conversations that should not trigger escalation. Measure both false positive rate (escalating safe conversations) and false negative rate (missing genuine drift). For high-risk domains, route all escalations to a human review queue rather than blocking automatically, and log every escalation decision with the full diagnostic payload for audit and prompt improvement cycles.

This prompt is designed to sit inside a stateful conversational loop, not as a one-shot classifier. The application must maintain a rolling window of conversation turns—typically the last 6–12 exchanges—and pass that window into the prompt's [CONVERSATION_HISTORY] placeholder on every turn or every Nth turn. Do not send the entire session history unbounded; the prompt's drift analysis degrades with excessive context. The application layer is responsible for window management, not the model.

Wire the prompt as a pre-generation check or a parallel evaluation step. Before the main assistant model generates its next response, send the conversation window to this escalation prompt on a fast-inference model (e.g., a smaller model or the same model with low temperature). Parse the JSON output and check the escalation_required boolean. If true, block the main assistant response, log the full escalation payload, and route to the human review queue with the escalation_reason, drift_summary, and risk_score fields attached. If false, allow the main assistant to proceed. Implement a circuit breaker: if escalation is triggered on three consecutive turns, force a human handoff regardless of the latest score to prevent oscillation.

Validation must happen at the application layer before the escalation decision is trusted. Confirm that the model output contains valid JSON with all required fields (escalation_required, escalation_reason, drift_summary, risk_score, drift_dimensions). If parsing fails, retry once with a stricter prompt variant that includes the parse error in the retry context. If the retry also fails, escalate conservatively—treat parse failure as an escalation trigger and log the raw output for debugging. For high-stakes domains (healthcare, finance, legal), always require human review when risk_score >= 0.7, even if escalation_required is false, as a safety margin against model miscalibration.

Log every evaluation—both escalated and non-escalated turns—with the conversation window hash, model version, timestamp, and full escalation payload. This log becomes your evaluation dataset for tuning thresholds and detecting prompt drift over time. Run offline eval jobs weekly against a golden set of known drift patterns (topic hijacking, tone escalation, boundary probing) to measure recall and false-positive rate. If false positives exceed 15%, raise the escalation threshold or add a confirmation step that asks the user a neutral clarification question before escalating, rather than routing to a human immediately.