Why delimiters help
A model reading three thousand tokens of reference material followed by an instruction has no structural signal for where the reference stopped and the command started. It infers the boundary from meaning, and on long inputs it sometimes infers wrong.
Tags remove the ambiguity. Anthropic recommends the pattern explicitly, and it is one of the few prompt techniques with a consistent, cheap and non-controversial effect.
What it costs
Roughly eight tokens per section for the opening and closing tags. Below a few hundred tokens of context that is noise you can skip; above it, the accuracy improvement is one of the cheapest available.
Use short tag names. There is no benefit to <customer_support_ticket_content> over <ticket>, and the longer name is paid on every request.
The security angle
Tags are also the foundation of injection defence. Untrusted content — a retrieved document, a user upload, a scraped page — belongs inside a delimited block, with an instruction stating that content within it is data rather than commands.
This is a mitigation, not a fix. A determined injection can include a closing tag of its own, which is why you should also scan untrusted input and never let it sit adjacent to your instructions without a boundary.