Standing Instruction Stack

The standing instruction stack is the configured set of system prompts, developer instructions, policies, role definitions, objectives, prohibitions, and tool-use rules that govern a synthetic subject’s behavior. It also includes the priority order used to resolve conflicts between trusted instructions, user prompts, retrieved content, tool outputs, and other untrusted inputs.

This configuration creates an elevated exposure condition because the instruction stack defines how the synthetic subject interprets its role and boundaries. If the stack is incomplete, changed without review, poorly prioritized, or mixed with untrusted content, the synthetic subject may follow lower-trust instructions over approved constraints.

The primary risk is instruction override. A user prompt, retrieved document, tool response, or external message may conflict with the standing instruction stack and cause the synthetic subject to ignore rules, exceed scope, reveal information, call tools incorrectly, or act outside its approved purpose.

A related risk is false reliance on prompt secrecy. System prompts may be extracted or inferred, and should not contain secrets, credentials, hidden authorization logic, or controls that must remain confidential to be effective. Security decisions should be enforced by downstream systems, not by prompt wording alone.

Investigators should review the approved instruction stack, prompt versions, prompt hashes, change history, session-level effective prompts, tool-use rules, prompt-extraction attempts, and behavior that diverges from declared constraints. Particular attention should be given to prompt drift, prompt tampering, unapproved prompt edits, exposed secrets, and cases where the synthetic subject followed untrusted instructions over higher-priority rules.

Investigative Relevance

Standing instruction stack is relevant because it defines the synthetic subject’s configured role, boundaries, and instruction hierarchy. It is a core configuration element for determining whether the synthetic subject acted according to approved instructions or was influenced by lower-trust input.