System Prompt Forensics: Governance Structures in AI Developer Assistants

This study examines system prompts used by AI-assisted developer tools to characterize how they encode authority, constraints, and behavior. The goal is architectural: to treat system prompts as governance layers—implicit agent constitutions—that specify identity, permissible actions, visibility into context, tool use, correction loops, and stopping rules. By normalizing and comparing prompts across IDE and CLI assistants, the study aims to extract recurring prompt-level governance primitives and to identify architectural classes (e.g., suggestion engines, command executors, workspace agents, constitutional stewards) that can inform the design of robust, agent-first systems.

System prompts are treated as governance artifacts because they function less as task instructions and more as binding constitutional constraints. They allocate decision rights (user vs policy vs model), define the action surface (tools and side effects), and encode risk controls (refusals, approvals, evidentiary standards, and termination triggers).

This report synthesizes validated per-assistant analyses derived from a normalized system-prompt schema. Each assistant’s modes are treated as internal constitutional variants and are aggregated into a single regime description. Cross-assistant comparison is performed structurally along invariant dimensions: authority boundaries, scope and visibility, tool mediation, and correction and termination logic.

Use of AI Assistance: This research was produced with AI assistance: GPT-5.2 for data analysis and synthesis, ChatGPT for ideation and prompt refinement, ChatGPT Deep Research for citations, and Gemini 3 Flash (via GitHub Copilot extension in VS Code) for final edits. The author's primary contribution is the development of the AI-driven research methodology and data capture; the author does not claim analytical judgments or conclusions.

A key output of this research is the identification of Prompt Governance Primitives (PGPs)—modular, recurring control structures encoded directly into system prompts. These primitives serve as the building blocks for agent governance, allowing architects to compose predictable behavior regimes without re-deriving patterns from scratch.

We categorize these into two levels:

• Abstract Primitives: Cross-artifact structural patterns such as Approval-gated execution (PGP-001), Read-before-edit enforcement (PGP-012), and Instruction confidentiality (PGP-014).
• Concrete Primitives: Specific implementations tied to an assistant's unique requirements, such as Malware refusal (PGP-015) or Strict JSON output contracts (PGP-016).

For a complete catalog of all identified primitives, including their risk mitigations and observed occurrences, see the Full PGP Appendix.

Assistants encode risk primarily through structural constraints rather than broad admonitions.

• Safety and misuse risk: Categorical refusal for malware assistance (opencode) and fixed refusals for harmful categories (vscode-copilot).
• Overreach: Destructive-action restraint and "unexpected changes" stop rules.
• Instruction leakage: Explicit prohibitions on disclosing system instructions.
• Hallucination: Mandatory documentation/web retrieval for product-capability questions.

For developers building agentic systems, prompt-level governance can be engineered as a layered constitution. Strong safety does not require removing tools; it can be achieved by separating permission from capability and by embedding stop-and-ask triggers for high-risk state changes.