AISPA: User-Centric System Prompt Auditing for Large Language Model Applications

System prompts are instructions configured by developers to govern the behaviors of foundation models in AI applications. They are used throughout commercial AI products, but are rarely disclosed to the public or regulators, creating a serious trust and accountability gap in the wide deployment of AI systems. In this paper, we introduce Artificial Intelligence System Prompt Assurance (AISPA), a user-centric framework for systematically auditing system prompts in AI systems. AISPA examines specific parts of a system prompt and evaluates them along eight dimensions that matter to users: whether the AI is transparent about its identity, provides truthful information, protects privacy, acts safely, respects user control and avoids manipulation, handles unsafe requests appropriately, helps prevent harm, and supports fairness, inclusion, and neutrality. We then use this framework to review 3,249 instructions from system prompts in 88 commercial AI products, classifying each instruction as either protective (of users) or problematic. Our audit surfaces four core findings. First, system prompt design varies substantially across products and developers, with some organizations averaging over 60 protective instructions per product while others average fewer than 5.

Introduction. With the rapid advancement of Large Language Models, LLM-based systems like customer service assistants, coding agents, virtual doctors, and companion chatbots are now used by billions of people around the world. Underlying nearly every deployed LLM-powered product is a system prompt: a set of developer-authored instructions that shapes how the model behaves before any user interaction begins. System prompts define the model’s persona, scope, and operational boundaries. They specify what the model should say, what it should refuse, whose interests it should prioritize, and how it should handle sensitive or ambiguous situations. System prompts constitute the primary lever through which developers configure a general-purpose foundation model into a specific product, and persist across user interactions with the product. Despite their role in shaping AI systems’ behavior, system prompts are rarely disclosed and are not subject to systematic independent review.

Discussion / Conclusion. We present AISPA, a comprehensive system prompt auditing framework comprises of an eightdimension taxonomy and an efficient human-in-the-loop auditing workflow. Using this framework, we conduct the first audit of 3,249 instructions from 88 system prompts of real-world AI products. Our audit reveals that while protective instructions have grown more common over time, coverage remains uneven across products and organizations, and roughly 40% of commercial systems contain at least one instruction that works against user interests. Beyond these quantitative patterns, our audit exposes a recurring class of gray area instructions that resist binary classification and surface deeper tensions between user autonomy and platform safety, and between organizational interests and the obligation to serve users. System prompts represent a consequential but largely ungoverned layer of deployed AI behavior.