Loading
Prompt engineering is the practice of designing, structuring, and iteratively refining the natural-language instructions given to a generative AI model so it reliably produces the output a user or application needs, without retraining or modifying the model itself. It draws on techniques such as supplying explicit context and examples, specifying output format and constraints, assigning a role or persona, and decomposing complex tasks into intermediate reasoning steps (chain-of-thought) or into a sequence of smaller linked prompts (prompt chaining). Prompt engineering matters for AI governance for two distinct reasons. First, the prompts and system instructions that steer a production AI application are functional, safety-relevant artifacts, so they warrant the same testing, review, and version-control discipline organisations apply to code. Second, the same instruction channel that carries legitimate prompts is the attack surface exploited by prompt injection, the vulnerability the OWASP Top 10 for LLM Applications has ranked as the single highest risk to LLM-integrated systems for two editions running.
Run the free AI Health CheckPrompt Engineering, the practice of designing, testing, and refining the natural-language instructions (prompts) given to a generative AI model to reliably produce a desired output, without modifying the model itself.
Prompt engineering spans techniques such as few-shot examples, chain-of-thought reasoning, role or system prompting, and prompt chaining. In a governed environment, production prompts and system instructions are treated as controlled assets: version-controlled, reviewed for bias, and tested against edge cases before deployment, because a poorly engineered prompt can produce unsafe or inaccurate output from an otherwise capable model. The same instruction channel is also the primary attack surface for prompt injection, the vulnerability OWASP's Top 10 for LLM Applications ranks as LLM01, its top risk to LLM-integrated systems, which is why NIST's Generative AI Profile (NIST AI 600-1) treats direct and indirect prompt injection as an information security risk requiring governance, pre-deployment testing, and incident-response actions.
Source: OWASP Top 10 for LLM Applications 2025 (LLM01: Prompt Injection); NIST AI 600-1, Generative AI Profile (July 2024)
Zero-shot prompting
Asking the model to perform a task from an instruction alone, with no worked examples, relying on the model's pretrained general knowledge.
Few-shot prompting
Including a small number of example input-output pairs in the prompt so the model infers the pattern and format expected of it.
Chain-of-thought prompting
Instructing the model to reason through intermediate steps before giving a final answer, improving performance on multi-step or logical tasks.
Role or system prompting
Assigning the model a persona, scope, or set of behavioural boundaries, typically via a system prompt that sits above user turns.
Prompt chaining
Splitting a complex task into a sequence of smaller prompts, where the output of one step becomes the input to the next.
Retrieval-augmented prompting
Inserting retrieved documents or data into the prompt at run time so the model answers from current, sourced context rather than memory alone, the technique underlying RAG.
Because a large language model does not structurally separate instructions from the data it processes, anything placed in its input, whether typed by a user or embedded in a document, webpage, or file the model reads, can potentially be interpreted as a new instruction. OWASP defines this as Prompt Injection: "a Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways." It has held the number-one spot, LLM01, in the OWASP Top 10 for LLM Applications across the 2023 and 2025 editions.
OWASP and NIST both distinguish direct prompt injection, where an attacker (or an unwitting user) types malicious instructions straight into the model, from indirect prompt injection, where the malicious instructions are hidden in external content the model later retrieves and processes, for example a poisoned webpage summarised by an agent, or a document ingested through a retrieval-augmented pipeline. NIST's Generative AI Profile (NIST AI 600-1) and its adversarial machine learning taxonomy (NIST AI 100-2) both treat direct and indirect prompt injection as a distinct, named class of generative AI security risk.
Prompt injection is also distinct from jailbreaking. OWASP treats them as related but separate attack vectors: prompt injection is the broader manipulation of a model's behaviour or output through crafted input, while jailbreaking is a specialised form of that manipulation aimed specifically at getting the model to disregard its safety training or guardrails entirely. A related, adjacent risk is system prompt leakage (LLM07:2025 in the OWASP list), where an attacker manipulates the model into revealing the confidential system instructions that were meant to constrain it.
Because prompts and system instructions directly shape an AI system's accuracy, bias, and safety, governance frameworks increasingly ask organisations to manage them the way they manage other production configuration, not as disposable text. Practical controls include a versioned prompt or template library with change history, review of new or modified prompts for bias and edge cases before release, restricted edit access to system prompts (given their role as a safety-relevant control and the LLM07 leakage risk), and monitoring of prompt and output quality over time.
NIST AI 600-1 maps its recommended actions on prompt injection to the four functions of the NIST AI Risk Management Framework: Govern (assign accountability and policy for prompt and system-instruction management), Map (identify where user- or third-party-controlled content reaches the model, including RAG and agentic tool use), Measure (test prompts and defences through recurring adversarial and red-team exercises), and Manage (respond to and disclose incidents involving prompt-based manipulation).
OWASP's guidance converges on a similar, defence-in-depth posture rather than any single fix: constrain model behaviour through specific system instructions, define and validate expected output formats, filter both inputs and outputs, enforce least-privilege access for any tool or function the model can call, require human approval before high-risk actions execute, clearly segregate and flag untrusted external content passed to the model, and run adversarial testing on a recurring basis.
What is prompt engineering in simple terms?
Prompt engineering is the practice of carefully wording, formatting, and structuring the instructions you give an AI model, including examples, context, and constraints, so it reliably produces the output you want. It changes what you ask the model and how you ask it, not the model itself.
Is prompt engineering still a relevant skill now that models are more capable?
Yes, though its centre of gravity has shifted. As models got better at inferring intent from short requests, the discipline moved from ad hoc trial and error toward documented techniques (few-shot examples, chain-of-thought, structured system prompts) that Anthropic, OpenAI, and Google Cloud all publish as best-practice guidance for production use, alongside a closely related emerging practice, often called context engineering, for agentic systems that must manage large amounts of retrieved context and tool output.
What is the difference between prompt engineering and prompt injection?
Prompt engineering is the legitimate, intentional design of prompts by a developer or user to get better output from a model. Prompt injection is an attack: per OWASP's definition, it occurs when user prompts or other input alter the model's behaviour or output in unintended ways, and it is ranked LLM01, the top risk, in the OWASP Top 10 for LLM Applications 2025.
What is the difference between direct and indirect prompt injection?
Direct prompt injection is malicious input typed straight into the model by a user. Indirect prompt injection is malicious instructions hidden inside external content, such as a webpage, email, or file, that the model retrieves and processes later, for example inside a RAG pipeline or an autonomous agent's browsing step. Both are recognised as distinct risk categories by OWASP and by NIST's Generative AI Profile (NIST AI 600-1).
Is prompt injection the same thing as jailbreaking?
No. OWASP treats them as related but distinct: prompt injection is the general manipulation of a model's behaviour or output via crafted input, while jailbreaking is a specific form of that manipulation aimed at getting the model to abandon its safety guardrails entirely. Because the mechanisms differ, OWASP notes they require different mitigation approaches.
How should organisations govern the prompts used in production AI systems?
Treat prompts and system instructions as change-controlled assets: keep a versioned prompt library, review templates for bias and edge cases before release, restrict who can edit system prompts, test against adversarial inputs on a recurring basis, and monitor output quality over time. NIST AI 600-1 maps equivalent actions to the Govern, Map, Measure, and Manage functions of the NIST AI Risk Management Framework.
Last reviewed July 2026
This page is general information about What Is Prompt Engineering?, not legal, regulatory, or professional advice, and does not capture every nuance or exception. Requirements change and can be fact-specific. Always verify against primary sources and your own qualified legal counsel before relying on it.