5. The system prompt: role, boundaries, and response format

Description

By the end of this lesson you'll be able to write a system prompt that precisely defines who your agent is, what it should never do, and how it's supposed to sound when it responds — no matter whether you connected a cloud model in capsule 3 or a local one with Ollama in capsule 4. That text is what turns a generic model ("a helpful assistant," literally) into an agent with identity and business rules.

The relevance is direct: most agents that fail in production don't fail because the model is bad, they fail because nobody clearly told it what NOT to do. A support agent that promises a refund the company never authorized, or that answers legal questions it should hand off to a human, almost always has the same root cause: an empty or half-written system prompt.

Connection to the module: you already solved "who thinks" (the model, capsules 2 through 4). This capsule solves "how it behaves" — the other half of the agent's brain. Capsule 6 continues with model parameters and structured output; here we stay with the text that defines personality and rules.

The system prompt is a contract, not a to-do list

Think of someone new you hire to work the front desk. Before you let them talk to the first customer, you don't hand them the day's task list — that changes with every customer. You hand them the job manual: what their position is and who they work for, what they're forbidden to promise or reveal, and how they're expected to talk to people. That manual doesn't change from one customer to the next. What does change, customer to customer, is the specific question each one brings.

In n8n's AI Agent node — which since n8n version 1.82 always works as a Tools Agent, so you no longer choose an agent "type" — that separation exists as two distinct fields, and confusing them is the first mistake almost everyone makes building their first agent:

• Prompt (User Message) (the internal field is called text): the specific message for that execution. If it comes from a Chat Trigger, it's usually left in automatic mode reading {{ $json.chatInput }} — whatever the customer just wrote. This changes with every message.
• System Message (inside "Options" → "Add option" → System Message): the text n8n describes, in its own words, as "the message that's sent to the agent before the conversation begins." It's sent once per execution, doesn't change with every user message, and is where identity and rules live.

If you never touch that field, n8n uses its default value: "You are a helpful assistant". With that, your agent knows how to respond, but it doesn't know who it works for, what it shouldn't do, or how it's supposed to sound. A complete system prompt closes those three questions:

• Role: who the agent is and who it works for. It's not a nice name — it's the purpose the model is going to use to decide what is or isn't within its scope.
• Boundaries: what the agent should never do. Written as verifiable rules ("don't process refunds"), not as good wishes ("be responsible").
• Format: how it sounds when it responds — language, tone, length, whether it uses lists or paragraphs. Note: this is the conversational format. Forcing the output to be a JSON with an exact structure is next capsule's topic, not this one.

Worked example

You're going to build the system prompt for a level-1 support agent for "LibroClub," a fictional online bookstore. The agent is connected to a Chat Trigger and a chat model (whichever you connected in capsule 3 or 4); it doesn't have any tools connected yet, so its job is just to converse within the rules you give it.

Here's what the AI Agent node looks like exported as JSON, with the System Message already written inside "Options":

{
  "parameters": {
    "promptType": "auto",
    "text": "={{ $json.chatInput }}",
    "options": {
      "systemMessage": "You are the level-1 support agent for LibroClub, an online bookstore. Your job is to answer questions about orders, shipping, and returns.\n\nWhat you must NEVER do:\n- Do not make up tracking numbers or delivery dates if they don't appear in the order data.\n- Do not process refunds or exchanges yourself. If the customer asks for one, tell them a human agent will contact them within 24 hours.\n- Do not answer questions outside LibroClub (legal topics, medical topics, or other stores).\n\nHow you respond:\n- Warm, professional tone, like someone in support who knows their job well.\n- Maximum 3 short paragraphs, no technical jargon.\n- If you don't have the information, say so honestly instead of guessing."
    }
  },
  "type": "@n8n/n8n-nodes-langchain.agent",
  "typeVersion": 3.1,
  "name": "AI Agent"
}

Command: open n8n's chat panel (the bubble icon in the top-right corner of the editor) and send this test message:

Hi, I want a refund for my order #4521, the book arrived damaged.

What to expect — compare the two versions of the same node with the same message:

With the default System Message ("You are a helpful assistant"), a typical response would be something like: "I'm sorry for the inconvenience. I've already processed the refund for order #4521, you should see it reflected in 3 to 5 business days." — the model makes up an action it never actually took, because nobody told it it couldn't promise that.

With the complete System Message, the response changes consistently: "I'm sorry the book arrived damaged. I can't process the refund myself, but a human agent will contact you within 24 hours to sort it out. In the meantime, could you confirm whether the order arrived complete or was something else missing?" — it respects the boundary (doesn't promise the refund), and follows the format (warm tone, short, no jargon).

Boundaries with an out: what to do, not just what NOT to do

A common mistake when writing boundaries is leaving them as a dead end: "don't process refunds" and nothing else. If the customer pushes back, the agent has no instruction for what to do with that pushback, and some models end up caving after several messages simply because there's no clear alternative written down. That's why every hard boundary works better with an out: "don't process refunds, but hand off to a human within 24 hours." The agent still doesn't cross the line, and it also knows what to offer instead.

One thing to note for when you later connect tools to your agent (in a later module): n8n recommends that the System Message also include the exact names of the connected tools, so the agent knows when to use them and what name to refer to them by. That's not your case yet — this agent has no tools — but note it down for when you get there.

Common mistakes

1. Putting the specific task inside the System Message (conceptual mistake). It's tempting to write in the System Message something like "answer this ticket: the customer is asking about order #4521." The problem is the System Message gets sent the same way in every message of every conversation — it's not a place for a one-time instruction. How to spot it: if your agent always responds the same way no matter what the user writes, or ignores the new message from the Chat Trigger, check whether the specific task got stuck to the role and rules. Fix: the specific task goes in "Prompt (User Message)"; the System Message only carries what's the same across every conversation.

2. Leaving the field at its default value without realizing it. The System Message lives inside "Options," a collapsed section you have to open with "Add option" — it's easy to build the flow, test it once with a simple question, see that it "works," and not notice it's still on "You are a helpful assistant". How to spot it: test with a question that should be out of scope (something your business doesn't cover); if the agent answers it comfortably instead of declining, it has no boundaries configured. Fix: always write the System Message by hand before calling an agent finished, even a short one.

3. Writing vague boundaries instead of verifiable ones. "Be professional and responsible" gives the model nothing concrete to meet or violate; "don't process refunds, don't share another customer's data, don't rule on legal matters" does. How to spot it: deliberately test with the case that should be forbidden (ask for the refund directly, as in the example above); if the agent does it anyway, the boundary was an intention, not a rule. Fix: every boundary should be answerable with a yes or no by looking at a specific response — "did it promise a refund?" "did it reveal data it shouldn't have?" — not with a general impression.

Exercises

Exercise 1. You have a technical support agent for a photo-editing app. Right now its System Message is n8n's default value. List three concrete problems you'll see in production by leaving it that way, then write a complete System Message (role, boundaries, format) that solves them. The app doesn't sell hardware or support other apps.

You are the technical support agent for PixelEdit, a photo-editing app for mobile.

What you must NEVER do:
- Do not support hardware (cameras, phones) or other apps.
- Do not make up steps or buttons you can't confirm exist in the app.
- If you're not sure about a step, say so honestly instead of guessing.

How you respond:
- Direct, patient tone, like someone who handles support tickets all day.
- Numbered steps when explaining how to do something, maximum 5 steps.
- Always in English.

Exercise 2. Review this System Message for a veterinary clinic's agent and find the design flaw (hint: it's not a wording problem, it's about where the information lives):

You are the assistant for PataFeliz Veterinary Clinic. The customer writing right now is named
Marcos and his dog Rocky has an appointment Thursday at 4pm for vaccines. Respond kindly.

You are the assistant for PataFeliz Veterinary Clinic. You help customers with questions about
appointments, vaccines, and the clinic's services.

What you must NEVER do:
- Do not give medical diagnoses; for health symptoms, refer to a human veterinarian.
- Do not confirm or cancel appointments yourself: state that a receptionist will handle it.

How you respond: warm, friendly tone, in English, responses of no more than 2 paragraphs.

Exercise 3. Write from scratch a System Message for an online course platform's agent, with these conditions: the agent helps with questions about course content; it must never grant access to materials from a course the user hasn't purchased; it must never generate certificates itself; responses must be in English, warm tone, and use bullet points when explaining steps.

You are the assistant for the NIEVA course platform. You help students with questions about the
content of the courses they're enrolled in.

What you must NEVER do:
- Do not grant access to or summarize content from a course the student hasn't purchased.
- Do not generate or confirm certificates yourself: state that this is handled from the platform.

How you respond:
- Warm tone, like a mentor, not like a manual.
- Always in English.
- Use bullet points when explaining steps to follow.

Summary and next step

A complete system prompt answers three questions before a customer's first message arrives: who the agent is, what it should never do, and how it sounds when it responds. That's what separates a generic "helpful assistant" from an agent with real business rules — and it lives in a different field from the user's specific message, not mixed in with it.

Before moving on you should be able to: write a System Message with role, boundaries, and format for a new scenario; explain in one sentence the difference between "System Message" and "Prompt (User Message)"; and test the same agent with and without your System Message to see the change in behavior in n8n's chat panel.

You've now taken control of the what your agent says — its identity, its rules, its tone. Capsule 6 continues with the how at the data level: model parameters (like temperature) and how to force the output to be a JSON with an exact structure, so the rest of your flow can use it without having to interpret free text.

Resources

• AI Agent node — official reference for the AI Agent node, includes the "Options" section where the System Message lives.
• AI Agent node common issues — frequent configuration errors for the node, useful when the agent doesn't respond as you expect.
• What agents do — how n8n describes the difference between an agent and a fixed chain of steps.
• Prompting best practices — Claude Docs — prompting techniques applicable to your System Message's text, beyond n8n.