What it means
Most AI applications prepend a block of instructions the end user never sees: who the assistant is, what it should and shouldn't do, what format to answer in, what tools it can call. This is the system prompt, and it is how a general-purpose model is turned into a specific product.
Models are trained to give system instructions more weight than user messages, so it works as a soft priority ordering. But it is a preference, not a permission boundary — the model can be argued out of system instructions, and a large sport of the field is doing exactly that.
System prompts also consume context and are sent on every request, so a long one is a fixed cost on every call.
Why it matters
Treating the system prompt as a security control is a common and serious mistake. It shapes behavior; it does not enforce anything. Any rule that actually matters — what data is reachable, what actions are permitted — has to be enforced outside the model, in code and permissions.
In practice
Put behavior and format in the system prompt; put security in your application layer. And assume the system prompt is discoverable — treat its contents as public.