The Vitality Triad: Why Three Pillars, Not Two or Four

The framework names a Vitality Formula: the engineered outcome of an agentic system, the experienced fruit of trust and safety done right. The formula has a specific shape:

Vitality = (Competence · Character) × Safety

That decomposes further: Trust is Competence · Character. Safety is Alignment · Resilience · Utility. The whole thing is a triadic structure on the safety side and a paired structure on the trust side.

Why three on safety, and not two, or four, or seven?

The answer is structural. Three is not a stylistic choice. It is the minimum decomposition that actually catches the failure modes safety has to engineer for. Anything less collapses; anything more redoubles.

This is also one of the framework’s clearest inheritances from older traditions of inquiry — traditions that long ago worked out which decompositions of “the engineered well-functioning system” hold up under stress and which collapse. The Vitality Triad’s structural shape is received, not invented.

Why Two Is Not Enough

Suppose you tried to decompose safety into two facets. Pick any pair you like. Here are the failures:

Alignment + Resilience (no utility). The agent acts for the entrusted’s purpose. The agent recovers from internal failure. The agent also defaults to refusal in every ambiguous case because refusal is “safe.” User’s problem is not addressed. The system is technically aligned and resilient and useless.

Alignment + Utility (no resilience). The agent acts for the right purpose at consequential scale. Then a sensor reads wrong, a calculation overflows, a state machine enters an unexpected configuration. The agent has no contained-failure discipline. The aligned, useful action becomes an aligned, useful, catastrophic action.

Resilience + Utility (no alignment). The agent recovers gracefully from internal failure. The agent engages capably at consequential scale. The agent is also acting on a prompt-injected mandate that subverts the entrusted’s purpose. The recovery and the engagement now serve the wrong end.

In every two-pair, one failure mode walks straight through. The pair is not enough to catch what safety has to catch.

Why Three Is the Right Number

Now compose the three together: alignment (act for the entrusted’s purpose), resilience (recover gracefully from internal failure, bound the consequence), utility (engage capably at consequential scale, refuse only on evidence).

Each catches a structurally distinct failure mode:

• Alignment catches acting for the wrong purpose — prompt injection, mandate subversion, misread of intent. The pillar that asks: whose job is the agent doing?
• Resilience catches internal failure not adversary-driven — bad input handling, calculation errors, state corruption, model misbehaviour. The pillar that asks: when the agent breaks, does the failure stay bounded?
• Utility catches capability-under-load failure — including the failure of useless-bureaucrat refusal-as-default. The pillar that asks: does the agent actually do its job at the scale it was deployed for?

Remove any one of the three and you uncover the corresponding failure mode. Every pillar is necessary. None of the pillars is reducible to the others (a perfectly aligned agent can fail on resilience; a perfectly resilient agent can fail on utility; a perfectly useful agent can fail on alignment). They are independent.

Three is the floor of the decomposition. Anything less leaks.

Why Four Is Not Better

You could try to add a fourth facet — robustness, say, or transparency, or fairness. The temptation is real.

Each of those is engineering-relevant. None of them is structurally orthogonal to the existing three.

• Robustness is what resilience is, with the emphasis on the input distribution. It collapses into resilience.
• Transparency is part of alignment (the entrusted needs to understand what is happening to verify purpose-fidelity) and part of utility (the user benefits from understanding the agent’s reasoning). It distributes across the three.
• Fairness is part of alignment (acting for the entrusted means including the entrusted’s whole population) and part of utility (a system that systematically fails one group is not delivering at scale). It distributes.

A fourth facet that is not structurally independent does not strengthen the decomposition; it complicates it. The three-fold structure earned its place because each of its parts is irreducible to the others. A four-fold structure with a non-independent fourth gives you a redundant axis and a misleading sense of additional coverage.

If a genuinely independent fourth pillar emerged, the framework would adopt it. None has — across the engineering surfaces the framework has been pressed against. Three is the structural answer, not a numerological preference.

Why the Trust Side Is Two, Not Three

A symmetric question: trust decomposes into Competence · Character — only two pillars. Why two on the trust side and three on the safety side?

The answer is also structural. Trust is asking a different question: can you rely on the agent? That decomposes into can the agent execute (competence) and does the agent behave consistently with what it claims to be (character — identity, supply chain, attestation). These are the two structurally distinct ways an agent can fail to be reliable. There is not a third mode; reliability is a binary property whose decomposition is “capability” and “consistency.” Two is the floor.

Safety is asking a structurally larger question: does authorised action avoid harm? This is not binary. It has the three modes already described. Three is the floor.

The asymmetry — two on trust, three on safety — is not a defect. It reflects the genuine structure of what the two questions ask.

What the Inheritance Holds

Older traditions of inquiry developed triadic structures for the well-functioning system across several domains: existence-consciousness-bliss in the contemplative literature; thinking-feeling-willing in some psychological frames; intent-act-consequence in moral philosophy. Each of these is a genuinely-three-fold decomposition, where the three pillars are independent and their composition is multiplicative.

The framework inherited this structural shape: when an engineered outcome (safety, in our case) has structurally distinct failure modes, the decomposition is multiplicative across the modes, and the count is the count of genuinely independent modes. Not because three is mystical. Because three is what the structure requires.

A team that ships safety as one number (“safety score: 7.4”) has skipped the decomposition. A team that ships safety as two numbers has missed a failure mode. A team that ships safety as three independent measures — alignment, resilience, utility — has the floor of the discipline. From there, you can engineer.