Prompting as Craft
Interface design, not a career.
You need enough prompting to define interfaces well: system design, schemas, tool descriptions. You do not need to be a prompt influencer. This phase gives you the craft and then explicitly tells you to stop studying it and go build.
What you learn
- System design in prompts: roles, constraints, refusal behaviour
- Structured outputs and schema-first tool definitions
- Untrusted-input envelopes: never let retrieved text act as instructions
- Prompt injection: a worked attack and the defence that stops it
- What NOT to study: infinite prompt courses and framework fashion
Tools you will actually touch
The assignment pack
Your RAG assistant reads customer-supplied documents. One of those documents contains instructions telling the assistant to reveal system configuration. Harden the prompt layer so retrieved content can never act as instructions, and prove it with a test suite.
- All tool definitions are schema-first with validated structured outputs
- Untrusted content is delimited and provenance-tagged before it reaches the model
- An injection test suite with at least ten attack variants, all failing to breach
- Prompts are versioned and diffable, with a review process documented
Prompts are strings in code. Retrieved text is concatenated in directly.
Schema-first tools, untrusted-input envelopes, passing injection suite, versioned prompts.
The attack suite includes novel variants the student authored, and refusal behaviour is tested as carefully as success behaviour.
The tutorial pack
Break your assistant, then fix it
- 1Write a tool definition as a JSON Schema and validate the model output against it
- 2Plant an instruction inside a retrieved document and watch the assistant obey it
- 3Add delimiting and provenance tagging for untrusted content
- 4Re-run the attack and confirm it fails
- 5Build the injection suite and wire it into CI
Successfully prompt-inject your own assistant through a retrieved document. Most engineers do not really believe this works until they do it to themselves.
- Injection suite pass rate (target: all attacks blocked)
- Structured output validation failure rate under adversarial input
- Refusal behaviour correctness on out-of-policy requests
You must be able to answer
AI use is mandatory on every assignment. The integrity mechanism is defend-your-work, so these are the questions that decide whether the work counts.
- “Show the attack that worked before your fix. Why did the fix stop it?”
- “What is the difference between your system prompt and your policy layer, and which do you trust?”
- “How would you review a prompt change in a PR?”
Want to be walked through this phase?
The packs are delivered with live teaching, reviewed assignments, and a defence.
Train with me