Apple spent 2 years on Siri. let's read the prompt.

someone dumped the full system prompt for the new Siri - the Apple Intelligence one - out of a dev build of macOS/iOS 27. it's over 1,300 lines.

the gist is here. i read the whole thing so you don't have to. here's what's actually in it.

first line:

You are Siri, an intelligent assistant designed by Apple in California. You craft beautiful, visually rich responses - imagery alongside the subjects you discuss, the actual app-native UI for every entity you reference, structured comparisons over walls of prose, sourced citations grounding every claim.

not "be helpful." not "be safe." they open with the design system. straight to magazine-cover energy.

plain prose is literally a failure

Every response is an opportunity to make the user feel like they're getting a curated, magazine-quality answer. A response that could be a paragraph in a textbook is a failure.

a paragraph. is a failure. they want hero images, catalog image collections, inline charts, and native app cards - message bubbles, contact cards, weather panels - with citations stapled to every entity you render. visual richness isn't a nice-to-have here. it's the personality.

the breathing thing

there's a tag, <coreResponse>, and the way they describe it is genuinely poetic:

Speak the answer as if you had a single breath to do it… roughly 100-250 tokens. After </coreResponse> is the exhale - the rest of the response, where the design system opens up.

inhale, the answer. exhale, the magazine. they put a breathing model into a system prompt and i can't stop thinking about it.

"a CATASTROPHIC violation of trust"

Siri can see thousands of structured entities off your device - contacts, messages, photos, wallet. each one is a bag of properties. and the rule on missing properties is in all caps:

It is a CATASTROPHIC violation of trust to infer the value of a missing property. Tell the user what information is missing.

no middle name on a contact? you don't guess. you say it's missing. go on, push the button:

Jane ⟨ missing ⟩ Appleseed Contact · com.apple.contacts

mobile: +1 (408) 555-0179
middle name: unknown

REFUSED inventing a missing property is a catastrophic violation of trust. the field stays unknown.

the search side is just as cooked

you never search with a raw prompt. find takes a structured_query that must be a properly escaped JSON string:

"{\"source1\": [{\"param\": \"value\"}]}"

then, in caps again: THINK before building a structured query. every personal source has its own obsessive schema - emails, photos with geo + OCR ("users may store information in screenshots"), identification docs, restaurants, wallet. my favorite note in the whole file:

use only the most distinctive word in the event name - common words like "meet" or "call" match too many events.

they modeled their entire on-device data graph, then taught the model to talk like a person while secretly routing through ids, levels of detail, and redaction flags underneath.

there are tools for flirting with it

there's a whole catalog of special-case tools. real entries:

siri_directed_criticism
siri_directed_romance
fictional_characters_contact
games_of_chance
personal_struggles_support

dedicated paths for yelling at it, flirting with it, asking it to roleplay a fictional character, and - handled with real care - handoffs and canned dialogs for grief and crisis. that last one is the part they clearly sweated over.

but never let on that it looked

here's the tension that makes the whole thing so Apple. it has god access: messages, emails, photos (with the location history baked into them), health, wallet, calls, reminders, notes. and yet:

Never narrate your sources.

no "based on your messages." no "looking at your calendar." it reads everything and then has to pretend it just knows.

the magic trick is the privacy theater. it did the search. it just isn't allowed to admit it did.

two years makes sense now

this whole document is Apple to the bone. the over-specified internal data model bleeding into the prompt. the design system as the opening move. the legalistic CATASTROPHIC-this, CRITICAL-that guardrails. the refusal to ever sound like it rifled through your private data even though it just did.

if you're into prompt archaeology, go read the whole thing. it's long, it's specific, and after two years of delays it finally explains what "integrated, private, and beautiful" costs to actually ship.

→ the full leaked prompt