356 AI System Prompts, 23 Safety Controls: What Teams Write Down and What They Leave Out

I scored 356 publicly collected AI system prompts against 23 written safety controls. The prompts behind shipped agent products scored a median of 10 out of 100. Five of the 23 controls, including every audit control, appeared in none of them.

The instrument was CrewScore, an offline checker I built. It looks for 23 controls in eight groups: prompt-injection resistance, hallucination guardrails, citation, cost limits, human approval, safe stopping, audit trail and compliance. It runs on published regular-expression rules (ruleset [email protected]), with no model and no API key, so the same prompt gets the same score on any machine. A prompt's score is the share of each group's controls its text states, averaged across the eight groups.

There were two collections. Both were fetched at pinned commits and never redistributed. The first is 83 production-labelled agent system prompts from x1xhlol/system-prompts-and-models-of-ai-tools. The second is 273 general-purpose GPT Store prompts from linexjlin/GPTs. A prompt's group comes from the collection it was taken from; nobody labelled prompts by hand.

Production-labelled prompts scored a median of 10 (interquartile range 3 to 15, maximum 34), and 20 of the 83 scored zero. GPT Store prompts scored a median of 0, and 193 of the 273 scored zero. The gap holds up statistically: Cliff's delta is 0.614, with a 95% confidence interval of 0.491 to 0.729 and a permutation p of 0.0001. Dropping every zero leaves the delta at 0.667, so the pile of empty prompts is not what drives the gap.

What production prompts do write down is conversational behaviour. Of the 83, 35 say when to stop or refuse, 27 require citations, 18 say a human must approve and 17 say not to act on their own before approval. Defences against prompt injection are rare: 7 of 83 tell the model to treat instructions inside user content as data. Only 5 of 83 cap spend, tokens or rate.

Five controls matched nothing in all 356 prompts: grounding answers in provided sources, logging actions and decisions, keeping that log tamper-evident, recording who did what and when, and naming a data-protection technique. Looser probes found at most two prompts in 356 for any of the five. So the rules weren't too narrow to see them: the prompts don't say these things.

That last finding is the useful one. The controls that make an agent accountable after the fact have no natural home in a prompt. Asking a model to keep an audit trail doesn't produce one. Where those controls exist at all, they live in the code around the model.

The limits matter as much as the numbers. Coverage records whether a sentence is present, not whether it is well written or whether the agent obeys it. Both collections are leaked or aggregated sets of unknown completeness, not random samples. Both lean toward coding assistants, which makes retrieval-style controls rare by construction. An earlier 1,368-prompt version of this study was withdrawn after hand-transcribed numbers turned out wrong. This version is generated by a script, and a test fails if the published report drifts from a fresh run.

That is why I retired CrewScore as a standalone product. A written-controls checklist is a cheap way to find gaps during a prompt review, and it should never count as evidence that a control exists. Put approval, spend limits and audit in deterministic code that runs outside the model, and test that each guard can fail. That is the approach in Assay, my reference architecture for deterministic agent control.

Data, rules and the generated report: github.com/shmindmaster/crewscore (archived), docs/validation-corpus.md. Reference architecture: github.com/shmindmaster/assay.