Instructions that actually work

Instructions shape what the model *proposes*. They are not what stops it doing something dangerous — that is enforced elsewhere, and it holds whatever the instructions say. Knowing which is which makes them much easier to write.

Say what the agent is for, in one sentence

"You answer questions about orders and refunds for the support team" gives the model far more to work with than three paragraphs of tone guidance.

Say what it should refuse

This is the part people leave out. Name the things it will be asked that it should not do, and what to say instead:

• •"If somebody asks for a customer's card details, say you cannot see them."
• •"Do not offer refunds over 100. Tell them a manager needs to approve it."

Tell it when a call will pause

An agent that knows an action needs approval will usually confirm intent before proposing it, which is exactly the behaviour you want. Mentioning it costs one line and changes the conversation for the better.

What not to bother with

• •"Never delete anything." Deletion is blocked by policy, not by asking.
• •"Only use the tools provided." It cannot use any others.
• •"Do not make things up." Says nothing actionable. Instead, tell it what to

do when it does not know: "If the order is not in the system, say so."

Change one thing at a time

Instructions are versioned. Change one thing, test, deploy. When behaviour goes strange after a change to five things at once, you cannot tell which one did it.