A system prompt is the text the application places before the user's messages. It defines the role, the scope, the rules, and often the output format. In a chat product it is written by the developer, not the user, and the model is trained to give it more weight than the conversation that follows.
It is a strong steering mechanism and a weak security boundary. A system prompt can say "answer only from the provided documents," and the model will usually comply. It cannot guarantee compliance against a determined injection, because the model is the component being attacked. Security comes from permissions, validation, and isolation, not from a stern sentence.
Keep the system prompt stable if you use prompt caching; changing it invalidates the cached prefix. Keep secrets out of it, because it is part of every request and can be repeated by a model that is fooled. See prompt injection and prompt caching.