Prompt patterns (few-shot, step-by-step, structured output)
Use this when: a plain prompt gives messy, wrong or inconsistent answers and you need a proven structure.
Text version
Everything on the sheet, as plain HTML: handy for screen readers, copy-paste and search.
6 patterns that fix most prompts
Add these to the six parts from the AI-01 sheet.
| # | Pattern | Use it when | Prompt starter |
|---|---|---|---|
| 1 | Few-shot | You need the same format or style every time | Give 3 to 5 varied input and output examples |
| 2 | Step by step | Troubleshooting, math or anything with logic | "Reason step by step, then give the final answer." |
| 3 | Structured output | The answer feeds a script, table or ticket | Return only JSON with keys: cause, fix, risk |
| 4 | Critique and revise | You need fewer errors in a draft or answer | "Check your answer for mistakes, then fix them." |
| 5 | Prompt chain | The job is big: split it into small prompts | 1) list the options 2) rank them 3) write it up |
| 6 | Ask first | Key facts are missing from your request | "Ask up to 3 questions before you answer." |
Pick by problem
| Problem | Pattern |
|---|---|
| Format keeps changing | 1 or 3 |
| Answer is rushed or wrong | 2, then 4 |
| Task is too big | 5 |
| Answer is too generic | 6 |
| Output goes into a tool | 3, then validate |
Structured output tips
- Name the exact keys and allowed values
- Say "JSON only, no extra text"
- Allow
nullor "unknown" instead of guessing - Parse and validate before you use it
- Show one finished example
Stack them: one prompt, four patterns
Example for SOC log triage:
- Role: You are a SOC analyst. Task: Triage the lines in <logs>.
- Few-shot: <example>denied tcp 198.51.100.7 to 192.0.2.10:22 => ACTION</example>
- Step by step: Reason through each line first.
- Structured: Then return JSON: [{"line": "...", "label": "ACTION|ROUTINE", "why": "..."}]
- Critique: Re-read your labels once and fix any mistakes.
Combine them
- 1 + 3: examples that all end in the same JSON shape
- 2 + 4: think it through, then review before the final answer
- 6 + 5: ask questions first, then run the chain
- 3 + 4: ask it to check its JSON against your keys
Wrap examples in tags and keep them varied so the AI does not copy one.
Use patterns safely
Aligned with the OWASP LLM Top 10 (2025).
Danger. Never run AI-written commands on production unread. Test them in a lab.
Caution. Validate JSON and commands before a script uses them. AI output is untrusted input.
Caution. Mask real data in your examples. Tag pasted text as data, not instructions.
Remember
- 3 to 5 varied examples beat a long rule list
- Step-by-step text can sound sure and be wrong
- One pattern at a time: test, then combine
Sources
- Anthropic, prompt engineering overview
- Anthropic, multishot prompting
- Anthropic, use XML tags
- OWASP Top 10 for LLM applications (2025)