Your System Prompt Has a Budget
Voice agents carry the longest, most-guarded system prompts of anything — don't reveal you're AI, stay on script, never quote a price, honor the knowledge base. We stacked 20 to 200 rules into a system prompt and counted how many each model still obeyed. Every model has a ceiling past which it silently drops rules — and it's lower than you think. gpt-5 holds ~200 but takes 10–66s to answer. gpt-5-nano collapses at 50. The winner for voice was the small open model: Cerebras Gemma held ~150 rules and never left 540ms.
The instinct, when a voice agent does something you don’t want, is to add a rule. Don’t say you’re an AI. Confirm the phone number before you look it up. Never quote a price you weren’t given. One question at a time. Each rule feels free — it’s one more line in a system prompt that’s already long. The unspoken assumption is that the model reads all of them and follows all of them.
It doesn’t. Past a certain number of rules, every model we tested started quietly dropping some — not refusing, not erroring, just silently ignoring a guardrail as if it were never written. We wanted the number: how many rules can you stack before a model stops reliably following them? Call it the model’s guardrail budget.
How we measured it
There’s a clean way to measure instruction-following without a human judge, borrowed from the IFScale benchmark: make every rule a required keyword. The system prompt says “include all of the following words in your reply,” lists N of them, and we count how many actually appear. A word is present or it isn’t — no judgment call, free to score, and it scales to hundreds of rules without them contradicting each other. It’s a stand-in for a real guardrail, but it measures the same underlying capability: how many simultaneous instructions can this model hold in its head at once?
We swept from 20 to 200 rules, three runs each, through the Speko gateway on four voice-viable models. “Budget” below is the rule-count where a model first falls under 95% obeyed — where it starts missing more than one rule in twenty.
The number
20–200 keyword rules, three runs each, deterministic scoring, through the Speko gateway on staging — 2026-07-10.
Three things fell out of that run that are worth more than the ranking.
1. Adherence is not the same as usable
gpt-5 has the best budget by a mile — it was still following 95% of two hundred rules. And it is useless for a voice agent, because it took 10 to 66 seconds to produce the reply. A guardrail the caller never hears because the model is still thinking is not a guardrail. The whole reason we measure latency and adherence together is that the model with the best obedience was the one you can’t put on a phone call.
2. The small open model won
cerebras:gemma-4-31b held 100% of the rules through 50, 99% at 100, and was still at 89% with two hundred rules loaded — while never leaving the ~400–540ms range, even at the top of the sweep. It was the only model that was both accurate and fast. The reflex is to reach for the biggest closed model to get discipline; here the small, cheap, open one on Cerebras was the right call for voice, and it wasn’t close.
3. Weak models abandon the later rules first
This is the actionable one. When a model runs out of budget, it doesn’t drop rules at random. We tracked whether the misses landed in the first third, middle, or last third of the list. At 150 rules, gpt-5-nano obeyed 51% of the first third and 1% of the last third — it kept the opening rules and abandoned nearly everything after. gpt-oss showed the same tilt (75 / 55 / 47). This is the “primacy bias” the literature predicts, and it’s a concrete instruction: on a weaker or cheaper model, put your most important guardrails first. The rule at the bottom of a long prompt is the first one to go. (Gemma, notably, stayed flat across positions — its misses were spread evenly, with the slight middle sag that is the classic “lost in the middle.”)
A note on what the model actually reads
One thing surfaced while measuring: the prompt the model sees is bigger than the one you write. A 10-rule prompt we sent was ~380 characters, but the gateway reported ~380 tokens consumed — roughly one token per character, which is impossible for plain English. The gateway wraps every request in its own system scaffolding, adding a few hundred tokens before your first rule. Your guardrails are competing for attention with instructions you didn’t write. Worth knowing when you’re deciding how much room you have.
Where we keep ourselves honest
A benchmark that only flatters is marketing. Four caveats.
These are keyword rules, not your literal guardrails. “Include the word lantern” is a proxy for “never quote a price.” It measures the same capacity to hold many instructions at once, but a behavioral guardrail graded by a judge is the real test, and it’s the next run.
The weak models are noisy at high load. At 100 rules, gpt-5-nano scored 23%, 58%, and 98% across its three runs — it doesn’t just decline, it becomes unpredictable, which for a production agent is arguably worse than a clean drop. The direction is solid; the exact breaking points for gpt-oss and nano need eight to ten runs before we’d stake a tight number on them. gpt-5 and Gemma were stable run-to-run.
Latency is from one fixed client, not your callers. Trust the gap between models — Gemma’s flat 540ms versus gpt-5’s tens of seconds — not the absolute millisecond. And one gpt-5 run logged a 37-second first-token time that was a transient hiccup; we excluded it rather than dress it up.
One snapshot, on staging. Routability and speed move week to week. This is where the four models stood on the day of the run, not a permanent law.
The takeaway
Every model has a guardrail budget, it’s lower than the prompt length would suggest, and it’s silent when you blow past it. Before you add the fortieth rule, know your model’s ceiling — and order your rules so the ones you can’t afford to lose sit at the top. For a live voice agent, the model that holds the most rules per millisecond, not the most rules, is the one to reach for. On this run, that was the small open one. See the models on the LLM board.
FAQ
How many rules can I put in a voice agent’s system prompt before the model ignores some?
It depends on the model, and the ceiling is lower than you think. In our 2026-07-10 sweep (20 to 200 rules, 3 runs each), gpt-5 held ~200 rules at 95% adherence, cerebras:gemma-4-31b held ~150, and both gpt-oss-120b and gpt-5-nano started slipping at ~50. Past the ceiling, rules get dropped silently.
Which LLM follows the most instructions at voice-agent latency?
cerebras:gemma-4-31b. It held ~150 rules at 95% adherence - still 89% with 200 rules loaded - while never leaving the ~400-540ms latency range. gpt-5 held ~200 rules but took 10 to 66 seconds to finish a reply, which is unusable on a live phone call.
Why does my LLM ignore instructions at the bottom of a long system prompt?
Weaker models abandon later rules first (primacy bias). At 150 rules, gpt-5-nano obeyed 51% of the first third of its rule list and just 1% of the last third; gpt-oss showed the same tilt (75/55/47). On a cheap model, put the guardrails you cannot afford to lose at the top.