One request, layer by layer

Figure 6.2 follows a single request through the stack. It is an example written for this page: the library, its rules, its hours and the conversation are all made up. A patron types six words into a library’s help-desk chat: “Is the library open on Sunday?”

Read the stack the way the model does, top to bottom. The system prompt supplies the date, Friday, May 22, so “Sunday” means May 24. The app instructions say what this assistant is for and what to do when it is unsure: give the front-desk number. The tool description tells the model it may ask for the hours on any date. The memory and documents layer holds a holiday notice, closed Sunday, May 24, and a saved note that this patron likes short answers. The conversation so far shows an earlier question about renewing a book. There are no tool results yet.

Now look at what a good answer needs. It needs the date, which the patron never typed. It needs the holiday notice, which the patron may not know exists. And it should be short, because the saved note says so. Of the seven layers, the patron wrote one. If the model asks for the hours as well, the harness runs the tool and adds the result below the patron’s message, and the model reads the whole stack again.¹ Change any layer above the message, say by dropping the holiday notice, and the same six words could get a different reply.

Who outranks whom

The layers don’t all carry the same weight. As of its October 2025 version, OpenAI’s Model Spec, the published rules its models are trained to follow, ranks them. When instructions conflict, OpenAI’s own rules come first, then the app builder’s, then yours.² Text that comes back from tools, along with quoted text and attached files, has no authority by default: any instructions inside it are to be treated “as information rather than instructions to follow.”² Anthropic publishes a document it calls a constitution, describing the values it intends Claude to have.³ Spot it today: look for a “model spec,” “constitution” or “system prompts” page from the company behind the model you use.

An illustration, not a real case. An accountant asks her firm’s AI assistant to help word a note to a client. The draft it writes ends with a line about the firm’s review policy, which she never mentioned. Nothing went wrong. The firm’s instructions, a layer above her message, asked for that line, and in the ranking above, the builder’s instructions come before hers. If she wants it gone, the person to ask is whoever set the tool up.

The ranking is a design, not a guarantee. A line of text inside a web page or a file can still be written to look like an order. Chapter 8 returns to what happens when a tool brings back text like that. And when people ask whether an AI tool is biased, the layers add a fair question to the list: what was it told before you arrived? Chapter 15 gathers the facts on bias.