---
theme: seriph
title: "Lesson 07 — Why Do Better Prompts Need Structure, Not More Rules?"
info: "English video course for AI Agents in Depth"
author: Bojie Li
transition: slide-left
mdc: true
lineNumbers: false
monaco: false
aspectRatio: 16/9
canvasWidth: 980
layout: cover
class: cover
---
Build · Chapter 2 · Context Engineering
# Why Do Better Prompts Need Structure, Not More Rules?
Process-oriented instructions, tool definitions, and injection boundaries
Lesson 07 of 42 · 18 minutes · Prompt Engineering; Tool Definition Design; Prompt Injection
---
# Why this problem matters
Organization
The model must retrieve the right instruction at the right step.
Execution
Rules should map to observable decisions and actions.
Trust
Untrusted content must never inherit instruction authority.
---
# Three ideas to keep in view
Behavioral frame
Tone and role set defaults—not guarantees
Process prompt
Organize instructions around a task flow
Layered defense
Prompt hardening + source boundaries + tool checks
---
# The book's visual model
Composition of an Agent context window
---
# Rule stack vs. Executable process
Rule stack
- Appended over time
- Conflicting priorities
- Hard to retrieve
Executable process
- Ordered stages
- Explicit conditions
- Observable outputs
Prompt quality depends on information architecture.
---
# Treat retrieved content as data
~~~python
content = web.read(url)
context.append({
"role": "tool",
"content": tag_untrusted(content)
})
policy.check(proposed_action)
~~~
---
# Test the claim
2-42 min
Inspect prompt-ablation results
Observe: Effect of organization, tone, examples, and tool descriptions
2-53 min
Compare an indirect injection with layered defense
Observe: Attack success with no defense versus combined defense
Demo budget: 5 minutes · one contiguous terminal block
---
class: course-terminal
---
Live demo
# Switching to the terminal
~~~bash
$ uv run python chapter2/prompt-engineering/analyze_results.py --output prompt-summary.json
$ uv run python chapter2/prompt-injection/demo.py -n 1 -a 2 -d 1,4
~~~
Run the command(s), narrate decisions, and point to the observation—not just the output.
---
# What the evidence supports
Finding 1
Disorganized correct rules can underperform a shorter process prompt.
Finding 2
Tool descriptions shape both action selection and argument quality.
Finding 3
Prompts reduce attacks but cannot form the final security boundary.
---
# Boundary → design rule
No system prompt can safely authorize irreversible actions using facts supplied only by the model.
Translate business policy into a process, then enforce critical invariants outside the model.
---
# Continue the experiment
---
layout: center
class: text-center
---
Pause and apply
# Your turn
Which sentence in your system prompt should instead be a tool-side invariant?
---
layout: center
class: text-center
---
Next · Lesson 08
Keep specialist instructions out of the prompt until the task actually needs them.
→