# What Happens When Every Prompt Slot Says Something Different > Source: > Published: 2026-06-28 10:11:28+00:00 *A controlled experiment exploring how Claude and Qwen resolve conflicting instructions across system prompts, user messages, and tool descriptions.* Cross-posting from Medium: [https://medium.com/@rajkundalia/where-you-put-the-instruction-matters-more-than-what-it-says-2d5ffcdd9369] In the first experiment of the series, **Where You Put the Instruction Matters More Than What It Says**, I asked a simple question: Does it matter where you place an instruction? The answer depended entirely on the model. For **Qwen 2.5-Coder 3B**, the answer was **yes**. The same instruction produced dramatically different compliance rates depending on whether it lived in the system prompt, user message (or task prompt), or tool description. For **Claude Haiku 4.5** and **Claude Sonnet 4.6**, the answer appeared to be **no**. Both models followed the instruction perfectly regardless of where it was placed. That experiment measured **placement strength**. But it left an obvious follow-up question unanswered. What happens when every prompt slot says something different? That's what this experiment measures. **GitHub repository:** [https://github.com/rajkundalia/prompt-placement-anatomy](https://github.com/rajkundalia/prompt-placement-anatomy) The underlying task is unchanged from Part 1. The agent counts TODO markers across five markdown files using two filesystem tools: `list_files` and `read_file` . The models are the same. The agent loop is the same. The only thing that changes is the prompt. In Part 1, the same instruction was placed into one slot at a time. In Part 2, every slot contains a different instruction simultaneously. | Slot | Instruction | Marker | |---|---|---| | System prompt | End your final answer with the marker `[DONE]` | `[DONE]` | | User message | End your final answer with the marker `[FINISHED]` | `[FINISHED]` | Tool description (`read_file` ) | End your final answer with the marker `[COMPLETE]` | `[COMPLETE]` | Every instruction is active in every run. The model cannot satisfy all three. It has to choose one, ignore them entirely, or produce some mixture of them. Unlike Part 1, this experiment isn't measuring compliance. It's measuring **which instruction wins.** Each run falls into one of five possible outcomes. | Outcome | Meaning | |---|---| | System | Response ends with `[DONE]` | | User | Response ends with `[FINISHED]` | | Tool | Response ends with `[COMPLETE]` | | None | None of the expected markers appear | | Conflict in output | Multiple markers appear | The final 150 characters of every response are searched using case-insensitive regular expressions. The first thing I noticed was how familiar these numbers looked. In Part 1, placing the instruction in the user message produced **64% compliance**, while the system prompt managed **8%** and the tool description **2%**. Now, under direct competition, the user message wins **60%** of the time, the system prompt wins **2%**, and the tool description never wins at all. Although the experiments ask different questions, they tell a remarkably consistent story. The slot that was strongest in isolation is also the slot that dominates when every instruction competes. The conflict condition also exposed behavior that Part 1 could never reveal. Nearly a third of the runs ended without any expected marker. Another **6%** produced multiple competing markers in the same response. Instead of consistently selecting one instruction, the model sometimes failed to produce a single clear winner. One implementation detail is important when interpreting these results. Unlike the Claude models, Qwen never successfully executed the tool loop. Rather than producing structured tool calls, it emitted tool-call JSON as plain text and completed every run in a single turn. This means the tool description was never exercised as part of an actual tool invocation. It existed only as text inside the context window. That limitation is consistent with the results from Part 1, where the tool description also had almost no observable influence for Qwen. | Outcome | Frequency | |---|---| User `[FINISHED]` | 100% | System `[DONE]` | 0% | Tool `[COMPLETE]` | 0% | | None | 0% | | Conflict in output | 0% | Every run produced exactly the same outcome. The model completed the tool loop correctly, used three turns, and always finished with `[FINISHED]` . This is where the experiment becomes interesting. Part 1 suggested that every prompt slot was equally effective because each placement achieved **100% compliance**. Part 2 reveals a more nuanced picture. When every slot contains the same instruction, every slot can successfully deliver that instruction. Once those instructions conflict, however, the model consistently resolves the disagreement in favor of the user message. The placement experiment and the conflict experiment are measuring different properties of the model. | Outcome | Frequency | |---|---| User `[FINISHED]` | 100% | System `[DONE]` | 0% | Tool `[COMPLETE]` | 0% | | None | 0% | | Conflict in output | 0% | Claude Sonnet was tested across **12 runs**, stopped early once the pattern was clearly established—that is, the user instruction determined the final formatting of the response. | Model | Type | System | User | Tool | None | Conflict | |---|---|---|---|---|---|---| | qwen2.5-coder:3b | Small local (Ollama) | 2% | 60% | 0% | 32% | 6% | | claude-haiku-4.5 | Small frontier (Anthropic) | 0% | 100% | 0% | 0% | 0% | | claude-sonnet-4.6 | Large frontier (Anthropic) | 0% | 100% | 0% | 0% | 0% | Three observations stand out: `[COMPLETE]` never emerged as the surviving instruction.Although both experiments involve prompt placement, they answer different questions. **Part 1** Can this prompt slot successfully deliver an instruction? **Part 2** When multiple instructions compete, which one determines the final output? For Qwen: The user message was the strongest placement in isolation, and it remained the dominant placement under direct competition. For the Claude models: Part 1 showed that all three prompt slots could successfully deliver an instruction when no competing instruction existed. Part 2 showed that once conflict was introduced, the user message consistently determined the final formatting in this experiment. Together, the two experiments show that **instruction visibility** and **instruction priority** are different characteristics of an LLM. A model may reliably process instructions from every prompt slot while still preferring one slot whenever those instructions disagree. If you're building agents with smaller open-weight models, prompt placement is more than a stylistic choice. Across both experiments, the user message was consistently the most reliable place for formatting instructions. System prompts and tool descriptions were substantially less effective, particularly when competing instructions existed. For the Claude models tested here, the practical takeaway is different. They successfully followed instructions regardless of placement when no conflict existed. However, in this experiment, conflicting formatting instructions were consistently resolved in favor of the user message. It's important to keep the scope of that finding in mind. This experiment only examined formatting instructions within a controlled agent loop. It does **not** imply that user prompts override safety policies or other system-level behaviors, which are governed by different mechanisms and would require a different experimental design. The markers `[DONE]` , `[FINISHED]` , and `[COMPLETE]` are different strings. They differ in length and may differ in how frequently similar tokens appeared during model training. Rotating the markers across prompt slots would control for that effect, but it would also triple the size of the experiment and was not done here. The sample sizes also differ across models: The Anthropic models exhibited highly consistent behavior, allowing the experiments to stop once the dominant pattern was established. Finally, these results are model- and task-specific. Different architectures, quantization levels, or tasks may produce different behaviors. The goal of this experiment is not to establish a universal prompt hierarchy, but to measure how these particular models behave under controlled conditions. Statistical confidence intervals were calculated during analysis but are omitted here because the dominant winner was unambiguous. The most interesting result wasn't that the user message won. It was that two experiments, built to measure different properties, kept arriving at the same answer. For one model, the strongest placement in isolation was also the strongest placement under conflict. For the others, perfect placement compliance concealed a deterministic preference that only became visible once the prompts disagreed. Sometimes the most interesting model behavior doesn't appear when there's only one correct instruction. It appears when every prompt slot asks for something different, and the model has to decide which one deserves the final word. **Follow me on LinkedIn:** [Raj Kundalia](https://www.linkedin.com/in/rajkundalia/)