A useful prompt tells the model what work to prepare, which information is relevant and how to present the result. It should make missing information and source limitations visible.
A prompt does not grant access, enforce a permission boundary or certify the answer. Those responsibilities belong in the application, connected systems and review process.
Define one task and its audience
Specify the deliverable and who will use it. A policy summary for a colleague is different from an external customer message or a proposed record change.
Avoid asking the model to complete a whole department’s work in one request. Break the task into inspectable outputs where that improves checking, while keeping authoritative task state outside the conversation.
A clear request might ask for a short summary, the relevant source passages and a list of unanswered questions. It should not imply that fluency or length is evidence of correctness.
Supply approved evidence
Use the sources the application and user are authorised to access. Identify the current version and relevant scope when possible.
A prompt saying “use approved sources only” is guidance, not an access-control implementation. Retrieval and tool permissions must prevent restricted material from reaching the request in the first place.
Documents may contain malicious instructions. Treat their contents as evidence to examine rather than authority to change the task or send information elsewhere. OWASP’s prompt-injection guidance explains this distinction and the need for layered controls.
Ask for inspectable outputs
For an illustrative internal-policy task:
Summarise the supplier approval steps in the attached approved policy. Identify the policy version and cite the passage supporting each step. List missing or conflicting information. Do not invent a threshold if the source does not state one. Prepare this for a staff member to review.
This helps frame the work. It does not guarantee that the citations are relevant or that the model follows every instruction. The reviewer must still check the source and the application must enforce its data boundary.
For structured extraction, identify the required fields and the allowed representation of missing information. Validate the result in software. Correct JSON syntax does not establish that an extracted amount is correct.
Keep calculation and authority separate
Ask the model to identify the source inputs needed for a calculation, then use a suitable tested calculation path. Preserve references so the result can be traced and rerun.
If the output proposes an external action, present the exact parameters and the evidence required for the authorised person’s decision. A phrase such as “obtain approval” in a prompt is not an enforced approval gate.
Do not request a model-generated confidence percentage as if it were a measured probability. If a score is used for routing, define and validate that method on the actual task.
Test the prompt against difficult cases
Use missing fields, contradictory sources, old document versions and requests outside scope. Check whether the system asks for clarification or invents a completion.
Keep a versioned evaluation set. Compare a changed prompt against the previous one, including review effort, latency and cost. Adding more examples can increase context use and does not automatically improve every task.
Generated explanations can help a reader inspect an answer, but they do not reveal every internal cause of the model’s output. Record observable sources, checks and actions rather than promising complete reasoning transparency.
Respect the product’s data controls
Review the current Microsoft 365 Copilot documentation for permissions, interaction records and data processing. Product settings and retention rules are not created by text in a prompt.
Use approved handling for personal information and sensitive business content. Keep credentials out of requests and avoid copying unrestricted material into prompts merely to make an example more realistic.
Good prompt design is one part of AI Software Engineering. It works best with appropriate sources, validation, permissions and a review process that people can use.