Match each role marker to the kind of content it should carry in a well-engineered context

Attempt it

system

developer

user

assistant

tool

Modern LLM APIs structure the prompt as a list of messages, and every message carries a role marker. The marker tells the model what kind of content it is reading and how much trust to give it. The system role carries the things that should not change from turn to turn: who the assistant is, what it must always do, what output shape it must produce. This is the persona and the policy. The developer role (in OpenAI's newer API, and conceptually similar to system in Anthropic and Google) carries application-level rules and tool definitions that the end user is not supposed to override. It sits above user trust. The user role carries the current human turn. The latest question and any user-supplied content go here. The model treats it as a request to act on. The assistant role carries prior model output: completed turns the assistant generated, plus any reasoning or plan blocks the agent has chosen to keep for continuity. The tool role carries the output of tool calls. Each entry should have a stable identifier so later assistant turns can cite it. Tool results live in the recent tail of the conversation, not in system. The smell to watch for is content in the wrong marker. Tool output stuffed into user content. Policies stuffed into the latest user turn. Each one degrades how the model reasons about the prompt.

Role markers are the structural contract between you and the model about what kind of content lives where. Five common markers, each with a distinct job. **system** is the static layer. Persona, hard policies, output schema, refusal rules. Content that should not change between turns, which is exactly the content prompt caching wants to keep byte-stable. **developer** is the application-rules layer (OpenAI's newer split; in Anthropic and Google APIs this content goes in system with explicit framing). Tool definitions, app-specific constraints, behavior the end user is not allowed to override. **user** is the current human input. The latest question, user-uploaded content, and any per-turn data the human supplied. **assistant** holds prior model turns. In an agentic loop, this is also where explicit plan blocks or scratchpad summaries the agent decided to retain go. **tool** holds tool-call results, each tagged with a stable id so subsequent assistant turns can refer to them. Tool messages live in the recent tail; old tool outputs get summarized or evicted. The operational principle is that the model has been trained to weight these differently. Putting tool output in user content makes the model treat it as a new request. Putting policies in the latest user turn makes them easier to jailbreak. The markers are not labels; they are part of the prompt's meaning.

Quick reference

TL;DR

Role markers split the prompt by content stability and trust: system and developer hold static rules, user and tool hold dynamic input, assistant holds prior model output.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Think of a workplace where every message gets stamped before it goes on the bulletin board. The boss's stamp goes on policies and dress codes that hang there all year. The team-lead stamp goes on project-specific rules. The customer stamp goes on incoming questions. The employee stamp goes on the answers your team already gave. The system stamp goes on receipts from machines on the shop floor. Everyone on the board reads the stamp before reading the message, and decides how much weight to give it. Role markers in an LLM prompt do exactly this stamping. The model has been trained to trust and use each stamp differently.

Key concepts

Context engineering Prompt engineering Agents

Detailed answer & concept explanation

~4 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.

Sign in for 5 free unlocks/day or go Pro for unlimited. See Pro pricing.

Quick scan · 2–4 min

Everything important, quickly.

4 minutes: name the five roles, explain trust and stability hierarchies, give one failure mode per misuse, name one production API that distinguishes developer from system.

Real-world examples

Real products, models, and research that use this idea.

OpenAI Responses API for GPT-5.5 explicitly distinguishes system, developer, and user roles with instruction-hierarchy semantics.
Anthropic Messages API for Claude Opus 4.7 uses a top-level system parameter for static rules and a tool_result content block inside user messages for tool outputs, with structural separation.
Google Gemini 3.1 Pro uses systemInstruction for static rules and a function_response part type for tool output.
LangGraph state graphs route each node's output into the right role marker automatically, which is part of why the framework feels cleaner than ad-hoc string concatenation.
OpenAI's June 2024 instruction-hierarchy paper trained models to weight system above developer above user; the 2026 generation inherits that property.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you defend against a prompt-injection attempt that tries to override the system message from user content?

Sign in or go Pro to see the approach for this follow-up.

QWhat goes wrong if you put a long static persona inside every user message instead of system?

Sign in or go Pro to see the approach for this follow-up.

QWhen does it make sense to put a plan or scratchpad in assistant role versus a separate scratchpad outside the message list?

Sign in or go Pro to see the approach for this follow-up.

Don't say this

Red flags and common mistakes that signal junior thinking. Click to expand.

Most common mistake

Putting tool results in the user message because that is where the new content arrived. The model treats user content as a request, not as evidence, and the contract blurs.

Sign in or go Pro to see all red flags and common mistakes. See Pro pricing.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.