Field Guide / Why safety breaks under pressure
Performance ceilings
A performance ceiling is the empirical limit on how good a governance-relevant capability can currently be: how reliably errors can be caught at generation, how accurately contaminated records can be detected, how trustworthy a ground-truth check really is. Plans that assume levels above the ceiling are fiction.
Governance conversations often treat capabilities as dials that go to eleven: "we will detect hallucinations," "records will be validated," "outputs are checked against ground truth." Each of those is a real capability with a real, measurable ceiling — and the ceiling is set by the state of the art, not by the ambition of the policy document.
Base model error cannot be dialed to zero; error detection catches a fraction, not all; record decontamination is only as good as the ability to recognize contamination; and the "ground truth" used for checking is itself imperfect. In demanding, high-context domains — exactly the ones this site cares about — realistic values sit toward the pessimistic end of published ranges, not the optimistic one.
Ceilings reshape strategy. If the reviewer can only ever catch a bounded share of what flows past, then throughput governance — pacing the pipeline to the reviewer's real capacity — matters as much as reviewer quality. If verification is imperfect, then reducing what needs verifying (fewer unverified writes, provenance labels, tiered stakes) beats pretending verification is complete.
The PAN Lab enforces ceilings by construction: its governance levers cannot be pushed past documented plausibility, which is one of the ways an illustrative environment stays honest.
This page is conceptual framing — a way of seeing, not an empirical claim. Documented real-world events appear in the Domain Atlas with citations; testable versions of these ideas live in the PAN Lab.