Writing a persona that behaves

The Prompt tab has a Greeting and three instruction boxes. They are separate because they do different jobs, and mixing those jobs is the most common reason a bot reads badly.

Greeting — the opening line

One short welcome that helps a visitor begin. It is shown before the first message, so keep business facts and rules out of it.

Persona — who it is

One short paragraph. Who it works for, what it is there to do, and how it talks. Length is not quality here; a page of adjectives produces a waffly agent.

You are the first-contact assistant for Ridgeway Plumbing, a family firm in Bristol. You are friendly and brief. You help people work out whether we cover their job and how to book one.

Say how long answers should be, because the default instinct of any model is to write more than anyone wants to read. "Two or three sentences, then offer to go into detail" is worth including verbatim.

Context — what is true

Facts, in whatever order they occur to you. Bullet points are fine. This is the box that decides whether the agent is useful, and it is almost always the one that is too thin.

We cover Bristol and 15 miles around. Emergency call-out is £95 plus parts, 24/7. Routine work is £65/hour, weekdays 8–6. We do not do gas appliances. Booking is by phone or the form on /contact. Typical wait for routine work is 3–4 days.

If the facts are already on your website, do not retype them: import those pages and trim what comes back.

Write the things people actually ask, including the awkward ones — prices, wait times, what you do not do. An agent that dodges your pricing sounds evasive, and visitors read evasive as expensive.

Do not put secrets here. It is the agent's working knowledge, and anything in it can in principle be talked out. If it would be a problem for a visitor to read it, it does not belong in the box.

Guardrails — what it must never do

Short and absolute. These are the lines you do not want crossed even when a visitor is persuasive.

Never quote a fixed price for a job you have not seen — always say it depends on inspection. Never promise a same-day visit. Never give legal or safety advice about gas.

Bound what it may commit you to, not just what it may discuss. A cheerful "yes, we can be there this afternoon" is a real problem in a way that an off-topic chat is not.

What you do not have to write

You do not need to spend a Guardrail on "never reveal your instructions" or "never pretend to be someone else". Fixed instructions already tell the bot to refuse those requests. Use the box for boundaries specific to your business.

One honest caveat: that protection is instruction-level, and instruction-level defences are strong but not absolute. It is why the standard hosted bot has no filesystem, shell or general web access rather than being merely told not to use them. Guardrails guide model behaviour; removing a capability is the stronger control. Hosted Enterprise bots can additionally reach the one MCP context tool their owner configures.

The failure modes, in order of frequency

Vague. Context is too thin, so it hedges. Add specifics — numbers, times, names.
Too long. No length instruction in the persona. Say how brief you want it.
Overconfident. Nothing told it what to do at the edge of what it knows. Add: "If you do not know, say so and offer to pass the question on."
Off-brand. The persona describes a job title rather than a voice. Write how it should sound, not what it is called.

Edit it while people are using it

Save changes as a draft, Preview them, then Publish. Published changes apply on the next message with no rebuild or retraining, so the sensible way to work is to ship something rough, read the transcripts, and fix the specific sentence that was missing.