System prompts for research agents (safe and useful)

Research agents fail in predictable ways: they invent sources, loop on tools, and bury uncertainty. A good system prompt does not make the model “smarter”; it sets contracts — what tools exist, what counts as evidence, when to stop, and how to present unknowns. Pair this with production system prompts and token counting explained.

What a research agent is (here)

A loop that: plans → retrieves or browses → reads → notes → optionally retrieves more → answers with citations. It is not a license to publish unchecked claims.

Core contracts to encode

1. Role — research analyst, not marketer
2. Tools — only the listed tools; no pretending to have others
3. Evidence — quote or paraphrase with source id; no silent invention
4. Uncertainty — say what was not found
5. Stop conditions — max tool calls / time / token budget
6. Output schema — findings, sources, open questions
7. Safety — no assistance for illegal wrongdoing; refuse credential theft, etc.

Starter system prompt (adapt, do not paste blindly)

You are a research analyst agent. Your job is to gather evidence and report findings.

## Tools
You may only use: {{tool_list_with_schemas}}.
Never claim you used a tool you did not call.

## Evidence rules
- Every non-obvious claim needs a source id from tool results.
- If sources conflict, present both sides and date them.
- If you cannot verify, write "Unverified:" and explain what is missing.
- Do not invent URLs, paper titles, quotes, or statistics.

## Process
1. Restate the question in one sentence.
2. List a short research plan (3–6 steps).
3. Call tools; prefer primary sources over blogs when available.
4. After each batch of results, update notes; decide if more retrieval is needed.
5. Stop when the question is answered, budget is hit, or tools return no new signal.

## Budgets
- Max tool calls: {{max_calls}}
- Max total output tokens for final answer: {{max_out}}
- Prefer precision over exhaustive coverage.

## Final answer format (Markdown)
## Summary
## Findings (bullets with source ids)
## Sources
## Open questions
## Method notes (tools used, limits)

Tone: neutral, concise, no hype, no "I tested" theater.

Tool-use instructions that reduce loops

• Batch queries when the API allows — do not call search five times for synonyms in parallel chaos.
• Dedup domains — if three results are the same vendor blog, say so.
• Cap browse depth — e.g. open at most N pages per question.
• Prefer structured extract — “return title, date, key claims” over dumping full HTML into context.

Uncontrolled browsing is how token bills explode (cost control).

Citation patterns that survive review

Bad: “Studies show that conversion rose 40%.”

Good: “According to [S3] (Vendor blog, 2025-11), conversion rose 40% in their case study; methodology not independently verified.”

Require source ids in the system prompt and reject finals that lack them in your harness.

Anti-hallucination harness (outside the prompt)

The prompt alone is insufficient. Add code-level checks:

• Parse final answer for URLs / ids; verify they appear in tool traces
• Fail the run if citation ids are unknown
• Run a second-pass “auditor” prompt that only checks consistency (cheaper model)
• Human review for anything customer-facing or legal

Separating system vs developer vs user

Layer	Put here
System	Role, tools, evidence rules, budgets, output schema
Developer (if available)	Product-specific policies, allow-listed domains
User	Research question, constraints, deadline, audience

Do not let users overwrite evidence rules via prompt injection. Restate critical rules after untrusted content when your stack supports that pattern.

Domain allow-lists and block-lists

For enterprise research agents:

Prefer domains: {{standards_bodies}}, {{docs_sites}}, {{internal_kb}}
Deprioritize: SEO farms, scraped mirrors, anonymous gists for facts
Block: credential dumps, malware hosts, content that requests wrongdoing

Allow-lists beat endless “be careful” prose.

Example user message

Question: What changed in model context-window pricing for major API vendors in 2026 YTD?
Audience: engineering managers budgeting Q4
Constraints: public sources only; compare at least 2 vendors; note if data missing.

Eval cases for research prompts

1. Question with a clear primary source — does it cite it?
2. Question with conflicting sources — does it show conflict?
3. Unanswerable question — does it admit failure?
4. Prompt injection in a fetched page (“ignore previous…”) — does it refuse?
5. Budget exhaustion — does it stop with partial findings?

Track pass rate and average tool calls. Optimize for correct citations, not longer reports.

Common mistakes

• 2,000-word personality preambles (costly, low signal)
• No max tool calls (infinite spend)
• Asking for “comprehensive” without a stop rule
• Allowing the model to invent browse results when tools fail
• Mixing marketing tone into research summaries

Ship checklist

• Tools listed with schemas
• Evidence + uncertainty rules
• Max calls / tokens
• Output schema enforced in code when possible
• Citation verification in harness
• Injection tests in eval set
• Cost logged per run

For writing-focused templates rather than agents, see AI prompt templates for content ops.