Field Guide / Why safety breaks under pressure
The robustness gap
The robustness gap is the distance between nominal safety — what evaluations, pilots, and vendor documentation established under controlled conditions — and real-world resilience: how the system behaves amid staff turnover, caseload surges, data drift, and all the improvisation of a live institution.
Evaluation happens somewhere calm. Deployment happens somewhere busy. Between the two sits the robustness gap: the accumulating difference between the conditions a system was tested under and the conditions it actually operates in.
The gap is not a sign that anyone lied. It grows from ordinary institutional life: the intake process changes, a data source drifts, experienced staff leave and are replaced by people who trust the tool differently, a budget cut removes the review step the safety case quietly assumed. None of these events touch the model — and all of them change what the system does.
This is why point-in-time assurance — an evaluation, a certification, an audit — has a shelf life. The documented failures in the Domain Atlas were, almost without exception, systems that had passed some form of review. What failed was everything that happened after the review, unobserved.
Governing the gap means treating deployment as the beginning of the safety question, not the end: monitoring the system's real behavior, re-checking assumptions on a schedule someone is accountable for, and keeping the authority to intervene close enough to act quickly. The concepts that follow — emergent misalignment, iatrogenics, ceilings — are the specific shapes the gap takes.
This page is conceptual framing — a way of seeing, not an empirical claim. Documented real-world events appear in the Domain Atlas with citations; testable versions of these ideas live in the PAN Lab.