Agent prompt standard
Normative patterns for reusable agent prompts that produce evidence instead of plausible prose.
A prompt in this section is a deliverable, not a note: it has been adversarially reviewed, it says what it does not cover, and it is one block you copy and run.
| Prompt | Produces |
|---|---|
| Audit a Java backend | A prioritised, proof-anchored security audit from a fan-out of specialist agents |
One prompt, one paste
A multi-agent prompt is still a single artefact. The subagent briefings live inside it, and the master hands each worker its briefing when it launches it — because the master already knows which worker it is starting, and the person running it should not have to.
A page that presents a master prompt and a set of worker prompts has published an assembly job. The reader now has to know which pieces go where, and will get it wrong. If a prompt cannot be run by copying one block, it is not finished.
What separates a prompt that works from one that reads well
Every rule below was paid for. They are the patterns that survived putting a draft in front of two independent models and keeping only what neither could break.
1 — A shared premise is a shared blind spot
A recon phase whose output every worker trusts turns one omission into correlated blindness across the entire fan-out. If recon misses a message consumer, nine agents miss it identically, and the report reads as thorough.
Mark every fact CONFIRMED, ASSUMED or UNKNOWN, and let workers correct
the map. A premise that cannot be contradicted is not a premise, it is an
allowlist.
2 — Silence is not coverage
A worker that returns no findings has told you nothing: it may have found nothing, or it may have read nothing. Require a coverage record — each unit examined and the control found — so an empty result is a claim you can check rather than a claim you must trust.
Self-reported coverage at the end of a report is the weakest form of this. Ask for it per unit, as the work happens.
3 — Give the model a mechanical recall floor
Under context pressure a model traces what it entered from and stops. A cheap deterministic sweep — grep-level patterns over the whole repository, run before the reasoning agents — produces a hit list that no agent can quietly not notice.
Judgement is what you want from the model; recall is what you should not ask it for.
4 — Fan out on one axis, and know which
A set of workers where some own a threat, some own a component and one owns a lifecycle stage is not a partition. Overlaps produce the same finding twice at two severities; gaps produce nothing at all and look like success.
Name the axis, make it exhaustive, and give every boundary exactly one primary owner. Contributors may add evidence; one agent adjudicates.
5 — The default verdict must not be silence
"Reject unless proven" sounds rigorous and quietly converts missing evidence into no problem. A candidate blocked only by a fact nobody could establish is not rejected — it is conditional, with the one fact required to resolve it named.
6 — Anything the model can fabricate, it will
Standards identifiers, scores and vectors are the worst offenders because they look verifiable. A confidently wrong requirement number survives review that a vague sentence would not.
- Ask for a catalogue identifier only where the catalogue is stable and widely memorised, or where you supply the mapping as a file.
- Never ask a model for arithmetic you can compute yourself. Ask for the inputs with justifications and do the sum outside the model.
- Where a framework default matters, require the version-resolved source — the auto-configuration class, the property, the lockfile version — or an explicit unverified label with capped severity. Defaults for a recent major release postdate the model's training and it will assert the old one with total confidence.
7 — Budget the output, or the tail is noise
An unbounded worker returns everything it can think of, ranked by nothing. Cap findings per worker, require them ranked, and send the tail to a named backlog rather than into the report.
8 — Structured records, not prose, cross agent boundaries
A master that dedupes free text dedupes badly. Define the record schema — identifier, evidence with file and line, path, control gap, confidence — so merging is mechanical and a missing field is visible.
9 — A claim is not evidence, and the difference is executable
Static reachability is an argument. A request that returns another tenant's data is proof. Where the stack can stand itself up, the highest-priority survivors should be confirmed dynamically, in isolation, and the transcript pasted in.
10 — Say what the fix breaks
A worker proposing a local fix does not see the boundary it violates. Require every fix to state what changes for legitimate callers, what migration it needs, and how to roll it back — and mark the classes of fix that must not be applied without a human.
Reviewing a prompt before it ships
Put it in front of at least one model that did not write it, and ask it to attack — not to improve. The two questions that earned their keep here:
- What will this miss? Not what is wrong with it — what falls between the workers, or belongs to no one.
- Which parts will be ignored or fabricated in practice? Instructions a model cannot follow are worse than absent ones, because they buy confidence.
See tools for running a second model, and decision records for the same discipline applied to decisions.