Skip to main content

Prompting as Interface Design

A production prompt is an interface between application state and a probabilistic component. Name the task, supply only necessary evidence, define the response contract, and version the template. Prompts can guide behavior, but they cannot enforce access control, keep secrets safe, validate output, or authorize side effects.

Prerequisites​

Understand the generation loop and ordinary software interface contracts.

Learning goals​

  • separate task instructions, evidence, and output requirements.
  • make missing and unexpected prompt fields observable.
  • keep authorization and validation outside the prompt.

Worked example​

The example builds a provider-neutral request object before any text rendering. The model adapter may render it differently, but the application can test the stable fields.

contract = {
    "task": "answer_question",
    "question": "How long are receipts retained?",
    "evidence": [{"id": "kb-retention", "text": "Receipts are retained for seven years."}],
    "response_contract": {"answer": "string", "citations": "non-empty string list"},
}
required = {"task", "question", "evidence", "response_contract"}
allowed = required
missing = sorted(required - contract.keys())
extra = sorted(contract.keys() - allowed)

print(f"task={contract['task']} fields={sorted(contract.keys() - {'task'})}")
print(f"missing={missing} extra={extra}")

Output:

task=answer_question fields=['evidence', 'question', 'response_contract']
missing=[] extra=[]

Keep prompt templates in version control and test them on a fixed task set. Changing examples, ordering, whitespace, or decoding can change behavior; an apparently small template edit is a system change. Never interpolate secrets merely to tell the model not to reveal them.

Common mistakes​

  • Relying on phrases such as “never ignore these instructions” as a security boundary.
  • Combining user text, retrieved text, and trusted policy without provenance labels.
  • Optimizing a single attractive example instead of a representative evaluation set.
  • Hiding assumptions, allowed fallback behavior, or required citations.

Practice​

Design a contract for extracting an incident date and severity. Identify which fields the model proposes and which fields application code must validate or authorize.

Next steps​

Structured Outputs and Validation checks a response before downstream code consumes it.

Primary sources​

Checked 2026-10-16: NIST AI RMF Generative AI Profile, OWASP LLM Prompt Injection Prevention, and Model Cards for Model Reporting.