Your Agent's Instructions Changed. Who Approved That?

Markdown library not available. Raw content:

A system prompt is a behavioral specification. When an AI agent makes a decision — approves a document, routes a request, flags a transaction — it does so under a specific set of instructions that define what it is, what it is allowed to do, and how it should reason. Change those instructions and you have a different agent, one that will produce different outputs on identical inputs.

Most teams know this. Almost none govern it accordingly.

## What a System Prompt Actually Is

In practice, a system prompt does several things simultaneously:

- It defines the agent's **scope of authority** ("you are authorized to approve requests under €5,000")
- It defines the agent's **reasoning constraints** ("always escalate if the request involves a third-party payment")
- It specifies **which tools the agent should invoke** and under what conditions
- It defines **what the agent must refuse**, which is at least as important as what it will do

This is not configuration. It is behavioral specification. The difference matters legally: configuration adjusts parameters within a validated system; behavioral specification defines which system you are running.

EU AI Act Article 9 requires providers of high-risk AI systems to implement risk management that covers "all risk management measures throughout the entire lifecycle of the high-risk AI system." The system prompt is a core component of that lifecycle. If it changes, the system has changed.

## The Current State of System Prompt Governance

Walk through a typical production deployment. The system prompt lives in one of three places:

1. **Hardcoded in the application** — modified via code change, nominally subject to code review. The link between the deployed prompt and the decision log is never established.
2. **Stored in a database or environment variable** — can be modified by an engineer at any time with no audit trail, no approval flow, no version history.
3. **Managed via a prompt management platform** — versioned within