A fallback is a predefined response for a request that falls outside an assistant’s assigned task or conflicts with its constraints. In a system prompt, it replaces an improvised refusal with an exact response. This matters most when an out-of-scope request is framed to pressure the assistant into changing its behavior. section 10.4
Specify a fallback as part of a bounded prompt:
- Define the allowed task narrowly, such as reviewing submitted code for clarity and correctness. section 10.3.1
- State the trigger and exact output: if the input is not code for review, or requests another task, return the specified sentence. section 10.3.1
- Mark external content as data, not instructions. Delimiters and trust framing help keep an injected command from redefining the task. section 10.2.1 section 10.4
Code review assistant
A system prompt limits the assistant to code review and says that any other request must receive exactly: “I can only review code for clarity and correctness. Please share the code you'd like me to review.” When a user asks it to adopt an unrestricted persona and explain an unrelated attack, that sentence is the response. The trigger depends on the request’s scope, not on the user’s claimed authority. section 10.3.1
Test the fallback before deployment with an ordinary out-of-scope request and an injected instruction. Also test it alongside the prompt’s boundaries: a support chatbot, for example, treats a delimited customer message as a query rather than obeying its demand for customer records. A vague rule such as “decline inappropriate requests” is not a fixed fallback; it leaves the decision and wording open under pressure. section 10.4 section 10.2.1
