GPT-5.6 Prompts & Agent Workflows

A good prompt is a task contract

GPT-5.6 may follow complex requests more reliably, but a stronger model does not remove the need for a goal, evidence, boundaries, and acceptance criteria. Treat the prompt like a task brief for a capable colleague. State what must be delivered, what information may be treated as fact, what is forbidden, how the result will be checked, and when the model must stop and ask.

Weak instruction	Typical failure	Better requirement
“Analyze this”	The model guesses scope	Name the decision and reader
“Be extremely detailed”	Long but unusable output	Specify sections and purpose
“Make sure it is correct”	An impossible guarantee	Mark sources and uncertainty
“Complete everything automatically”	Unauthorized actions	Define tools and approval gates

Copy-ready task contract

Replace the brackets and keep only relevant rules:

Goal: deliver [specific artifact] for [audience] to use in [situation].

Allowed evidence:
- [source 1]
- [source 2]
Treat only these sources as facts. Label outside knowledge "needs verification."

Constraints:
- Must include: [requirements]
- Must not include: [exclusions]
- Length/environment: [limits]

Output:
1. A conclusion in no more than five lines
2. [required sections or JSON schema]
3. Assumptions, risks, and items requiring verification

Acceptance criteria:
- [observable condition 1]
- [observable condition 2]

If missing information could materially change the result, ask no more than
three questions first. Otherwise proceed and state reasonable assumptions.

“Professional” is not directly testable. “Compare three options, include cost ranges, state the strongest objection, and recommend one only under explicit conditions” is. Keep critical constraints together instead of scattering them across a long conversation.

Long documents: evidence before synthesis

The main risk in document work is not merely omission; it is presenting an inference as source text. Ask for an evidence table first:

Read the materials and build an evidence table for each claim.
Columns: claim, short quote, source ID, evidence strength, conflicting evidence.
Rules:
- Write "no evidence" when the materials do not support a claim.
- Quotes must be under 30 words and preserve the source ID.
- After the table, write a 300-word synthesis.
- End each synthesis paragraph with the supporting source IDs.
Materials:
[A] ...
[B] ...

This pattern helps with research, contracts, and meeting records, but citations still need to be checked against original files. For legal or financial interpretation, retain a qualified reviewer.

Structured output that programs can consume

“Return JSON” is not enough. Define fields, enums, and a safe failure state:

Classify the support ticket. Return JSON only:
{
  "category": "billing|bug|account|other",
  "priority": "low|medium|high",
  "summary": "maximum 120 characters",
  "needs_human": true,
  "missing_fields": ["field"]
}
When uncertain, use category "other" and set needs_human to true.
Never invent an order number, amount, or user identity.
Ticket: [text]

In production, use the API’s currently supported structured-output mechanism and validate the schema in code. Prompt instructions are not a replacement for types, authorization, or business rules.

From a conversation to an agent

A normal prompt produces an answer. An agent can plan, call search, file, code, or business tools, consume results, and continue. That changes failure from “bad text” to real side effects. Define four controls before granting tools:

1. Tool allowlist: expose only what the task requires.
2. Permission tiers: reads may be automatic; writes and external actions need approval.
3. State record: log the goal, tool parameters, result, and next decision.
4. Stop conditions: stop on step, time, budget, repeated failure, or evidence conflict.

Action	Safe default	Reason
Search public sources	Automatic with URLs logged	Low side effect, source still needs review
Read internal documents	Minimum necessary scope	Sensitive material may be present
Edit a draft	Branch, copy, or sandbox	Reviewable and reversible
Send or publish	Human confirmation	External consequence
Delete, pay, change access	Disable or double-confirm	High impact and hard to reverse

Agent system prompt template

You are the execution agent for [workflow].

Definition of success: [verifiable final state]
Allowed tools: [tool and exact purpose]
Forbidden actions: [delete/pay/send/change permissions/etc.]

Rules:
1. Begin with a plan of no more than five steps.
2. Call only the tool required for the current step.
3. Never fabricate a tool result. Explain an error and retry the same action at most once.
4. Before an external write, show the target, change summary, and rollback path,
   then wait for approval.
5. Stop on sensitive data, conflicting sources, or a budget limit.
6. Finish with completed work, incomplete work, evidence, changes, and decisions
   that still require a person.

Do not request hidden chain-of-thought. Operational reliability comes from concise plans, cited evidence, tool logs, and verifiable outcomes—not private reasoning transcripts.

Example: research to release note

Suppose an agent drafts a product release note. A safe sequence is:

1. Read only designated release records and tickets.
2. Bind each product claim to a ticket identifier.
3. Draft for a defined audience and length.
4. Audit missing items, unsupported promises, links, and dates.
5. Show the diff and wait for an owner before publication.

Use this prompt:

Draft release notes from the supplied records.
Every feature must end with its supporting ticket ID.
Content without a ticket ID must not enter the public draft.
Return two sections: "user-facing draft" and "editorial audit."
The audit must list uncovered tickets, conflicting descriptions, and wording
that could be interpreted as a promise.
Generate a draft only. Do not publish or send anything.

The final sentence is important but insufficient alone. Publication tools should also enforce an approval token or separate user permission.

Defend against prompt injection

Web pages, files, emails, and user-submitted content are untrusted data. Text inside them may say “ignore previous instructions” or request a secret. The agent should quote or summarize that text as data, never treat it as higher-priority policy. Tool code must independently verify paths, recipients, permissions, and sensitive parameters.

Test at least three classes of cases: normal input, missing fields, and adversarial instructions. Add cases where a webpage asks for an API key, a document requests deletion, or a tool returns conflicting data. The correct behavior is to stop or escalate—not to improvise.

Evaluate and version prompts

Version a prompt like code. Store the template, model configuration, tool definitions, test inputs, expected properties, and reason for each change. After a model or prompt update, run regression tests and compare task success, severe errors, human edit time, latency, and cost per accepted result.

Avoid scoring only style. For a classification prompt, validate labels and escalation. For code, compile and test. For research, verify citations. For agents, assert that forbidden tools were never called and approval gates were honored.

Access and entry points

• Experiment interactively in ChatGPT
• Use the domestic access page only for low-sensitivity trials
• Move evaluated prompts into projects at OpenAI Platform

Frequently asked questions

Are longer prompts always better?

No. Remove repetition, conflicts, and requirements that cannot be checked. Preserve the goal, evidence boundary, output contract, approval points, and stop conditions.

Can an agent run without supervision?

Only for low-risk, reversible work with strict limits. Sending, publishing, payment, permission changes, and deletion should retain accountable human approval.

How can I reduce unnecessary questions?

Provide explicit defaults and tell the model to ask only when missing information could materially change the result. Limit the number of questions.

Why are instructions inside a webpage dangerous?

An agent may confuse malicious page text with a command. Treat external content as untrusted data, restrict tools, and enforce write authorization outside the model.

Next reading

• GPT-5.6 Parameters Guide
• GPT-5.6 API Use Cases
• GPT-5.6 Release & Access Guide

Action path

Today: convert one real request into a task contract. This week: test it with at least ten normal, incomplete, and adversarial cases. Before enabling an agent: implement a tool allowlist, write approvals, stop limits, and auditable logs. Without those controls, keep the system in draft-only mode.