Click any words you think contain an error. Click again to unmark.
Mark at least one word to submit.
The flaw is that every rule in the system prompt is a prohibition. DO NOT, NEVER, AVOID, DO NOT, DO NOT, NEVER. Six in a row.
A prohibition tells the model what not to do but does not tell it what to do instead. To follow each rule, the model has to imagine the prohibited action and then suppress it. When you stack six prohibitions, the model has to suppress six things at once, and the suppression often fails inconsistently.
You can see the failure in the example reply. The user asked a normal question about delivery, and the assistant answered by quoting the prohibition back: 'I cannot make specific promises about delivery times.' The model fell back on restating the rule because there was no substitute behavior attached to it.
The fix is to rewrite every prohibition as a positive 'when X, do Y' rule. 'For delivery questions, share the tracking link and the estimated arrival from order details.' Now the model has an action to take, and the answer is helpful instead of evasive.
The system prompt is a stack of six negative directives, and the assistant's reply shows the failure mode directly. The user asked a legitimate delivery question; the model parroted the prohibition back instead of helping. This is the canonical negation-heavy prompt anti-pattern.
The mechanism is that each prohibition requires the model to model the forbidden behavior and suppress it. Six stacked suppressions overload the attention pattern. Some prohibitions stay tight, others slip, and the model often defaults to restating prohibitions because that is the safest visible behavior consistent with the rule.
The fix is structural. Replace every rule with a positive substitute that names a recognition condition and an action. For delivery questions, share the tracking link and the estimated arrival from order details. For feature requests, acknowledge them and direct the user to the public roadmap. For refund requests outside policy, route to a formal claim via the support portal.
The rewritten prompt covers the same surface but gives the model a clear action for every trigger. Per-rule compliance typically lifts ten to thirty points, and the visible failure of restating the prohibition disappears because the model has somewhere else to go.
Quick reference
TL;DR
Six stacked negations force the model to suppress instead of act; the assistant ends up restating the prohibition back to the user instead of answering.
Imagine training a new support agent by handing them a list of six things they must never do, with no advice on what to do instead. The first day a customer asks where their package is, the agent panics and says 'I cannot promise delivery times,' because they only remember what they were not supposed to do. LLMs behave the same way when a prompt is a stack of prohibitions. Each rule forces the model to think about the forbidden action and then suppress it, and the assistant ends up parroting the prohibitions back to the user instead of solving the problem. The fix is to give the agent positive actions tied to triggers, so they know what to do, not just what to avoid.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Hard safety prohibitions with no useful substitute behavior Some rules (do not produce harmful content) cannot be reframed; keep the negation and pair it with positive refusal guidance.
Single sharp negation that is already complying reliably A lone, well-targeted prohibition can work fine; the failure mode is mostly about stacks of negations competing for suppression budget.
Compliance training where the prohibition is the user-facing behavior Refusal scripts need to refuse explicitly; the structural negation is the policy, with positive framing applied to the refusal language itself.
Quick scan · 2–4 min
Everything important, quickly.
3 min: count the negations + name prohibition mirroring + reframe each rule as trigger plus action + verify with per-rule eval + leave only hard safety prohibitions in negative form.
Real-world examples
Real products, models, and research that use this idea.
1Anthropic's prompt-engineering guidance for Claude Opus 4.7 calls out long prohibition lists as a top driver of evasive, restate the rule responses.
2OpenAI's GPT-5.5 docs recommend replacing 'do not' rules with 'instead do' patterns and document the compliance lift teams typically see.
3Customer-support deployments on Intercom Fin and Zendesk AI ship system prompts structured as trigger-action maps rather than prohibition lists, specifically to avoid prohibition mirroring.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you measure that the rewrite actually fixed the behavior?
Sign in or go Pro to see the approach for this follow-up.
QWhat if compliance with the new positive rules drifts over time?
Sign in or go Pro to see the approach for this follow-up.
QWhen would you keep a negation in the prompt anyway?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Diagnosing the failure as 'the model is too cautious' instead of the structural cause: every rule is a prohibition with no substitute action attached.