A system message is the instruction handed to a chat model at the start of a conversation, and the user never sees it. It describes who the assistant is, what it helps with, what tone to use and what to stay out of. Every message the user sends is then read inside that frame.
Structurally it is just another message, but the model weights it differently. Chat APIs send messages with system, user and assistant roles. Text in the system role stays in context for the whole conversation, so the instruction still applies after the user changes subject. Its pull can fade in very long threads, which is why critical rules sometimes get repeated inside the user turn as well.
In practice this is where product behaviour gets defined. A bank's support assistant might be told through its system message to answer only on accounts and cards, to give no investment advice, and to route the customer to a human whenever it is unsure.
A worked example: an ecommerce product assistant is told to discuss only items in the catalogue, to read prices from the live data source every time, and never to recommend something out of stock. When a shopper asks about a competitor product, the model holds that boundary and steers back to the catalogue.
A system message is not a security control. A well-built prompt injection can try to talk past it, so real permission checks stay in the application layer.
