Overview
The Prompt Configuration System is a unified, versioned system for all LLM prompts used by agents — system prompts, welcome messages, KB context injection templates, and additional prompt types — managed through a single governed system. Key features:- Prompt type registry enforcing what types exist and how they behave
- Per-agent prompt overrides with
fixed(static text) orgenerated(LLM-driven) modes - System defaults used when no agent-level override exists
- Dynamic variables (
{{variable_name}}) injected at runtime - Semantic versioning (major.minor) with changelog on all configs
- Streaming configuration at agent and request level
Data Model
prompt_type_registry
Governs all valid prompt types. No prompt config can reference a type not in this table (FK constraint).
Initial registry entries:
bot_prompt_configs
Per-agent prompt overrides. One row per prompt type per agent. UNIQUE on(bot_id, prompt_type).
system_prompt_defaults
Platform-wide defaults. One row per prompt type. Used when no bot-level override exists.conversation_variables
Per-conversation resolved dynamic variables.Three-Tier Resolution Flow
This three-tier fallback ensures the system always works even if config data is missing.Welcome Message Flow
- Fixed Mode
- Generated Mode
- No Welcome
Versioning System
Version Numbering
- Major.Minor format (e.g.,
1.0,1.3,2.0) - Minor bump: Content edits, wording changes, variable adjustments
- Major bump: Mode changes, structural changes, breaking variable contract changes
Version Bump Logic
Rollback
Restoring a previous version creates a new version entry with changelog “Rolled back to vX.Y”. History is never rewritten.Streaming Configuration
Effective Behavior
bots.streaming_enabled(BOOLEAN, default: true) — agent-level togglestreamparam onPOST /bots/:id/chat(default: false) — client declares capability
Adding New Prompt Types
New prompt types require a DB migration with these fields:key— unique, immutable machine identifierlabel— human-readable namedescription— clear explanation of purposecategory— one ofchat,rag,engagement,toolssupported_modes— which modes are validdefault_mode— must be insupported_modes
API Endpoints
Bot Service — Prompt Config
Auth Service — Superadmin
Security
- Sensitive variables: Stored encrypted via
packages/shared/src/crypto.ts. Never returned in client-facing responses. - Signed context tokens: JWT with expiry; validated server-side on every use.
- Prompt injection: Variables should be wrapped in quotes or XML tags in LLM prompts.
- Access control: Bot prompt configs scoped to bot owner’s org (existing RBAC). Registry/defaults endpoints require superadmin.

