The Trust Integral

On the Several Meanings of Trust, and the One That Can Be Measured

Originally published on Medium, April 25, 2026.

At 2:47 in the morning, an analyst is watching a dead man log in to the corporate VPN.

Every signal in the stack agrees the session is legitimate. The device fingerprint matches the historical baseline. The behavioral biometrics fall within tolerance. The multi-factor token is clean. The identity verification model returns a confidence score of 0.97. The person it is verifying died of a stroke in 2024.

This is what happens when the cost of producing an honest signal collapses while the cost of verifying one stays high. AI is not breaking trust. AI is changing the price of trust. Until you can name the variable AI is moving, you cannot govern what it is doing.

The board, three floors up, asks how trust is holding up. The CISO opens her zero-trust dashboard, which measures verification, not trust. The CHRO opens engagement scores. The CFO opens brand-tracking. Three answers, three blind spots. None of them sees the analyst on the night shift.

Outside that room it gets worse. Sales calls trust relationship velocity. Legal calls it contract. The same word, several different objects, no two of them measuring the same thing.

When a word means several things, the risk it names cannot be measured, governed, or repaired. Most enterprise trust frameworks land somewhere between sentiment dashboards and Nelson-Mandela quote walls.

That used to be a management problem. It is now an architecture problem. If you can't define what trust is in language portable across departments, you can't audit what AI is doing to it.

I've spent at least twenty-three years watching trust fail in fraud detection, in network defenses, in identity infrastructure. The vocabulary in this essay is what I needed when risk, threat, and exposure kept missing what was actually breaking.

There is a place I keep returning to that already solved this problem. The institution that solved it has been running, in some form, for centuries.

I live in Las Cruces, in southern New Mexico. The acequias run through this state — north and south, valley after valley — and the people who depend on them gather every spring to work things out. Who cleans which section of ditch. How long the upstream users have the water before it moves down. Whether someone joining the system this year understands what they are signing up for. The deliberation is the system. The ditches were named acequias about four hundred years ago, when Spanish colonists carried the word and the legal tradition north. The practice was older still: shaped by Moorish irrigation in Iberia and by Indigenous water governance already present in these valleys. The institution is older than its current name.

What the mayordomos — the elected ditch-bosses who steward each acequia — are doing, when they gather, is running an audit. They don't call it that. They call it the limpia, the cleaning. Once a year, every shareholder shows up at dawn with a shovel. The work is cold and unpleasant. The mayordomo keeps a list of who worked, who sent their sons, and who didn't bother showing up.

That is what trust looks like as a working system. The price of using the water is paying it in full view of neighbors who will see you again next year. When somebody takes more than their share, there is a documented repair protocol: public hearing, restitution, in extreme cases loss of water rights.

The acequia is not a metaphor. It is a centuries-old instance of the equation I found and I want to share with you.

The definition

Trust is a load-bearing relational condition maintained by costly, reciprocal, witnessed, repairable interaction over time.

Eight predicates. Each is testable. None is decorative.

• Load-bearing. Things rest on it. When it fails, things fall. Trust is structural, not cosmetic.
• Relational. It lives between parties, not inside them. You don't have trust the way you have a credit score.
• Condition. A state the system has to maintain. Trust decays without contact.
• Costly. Free signals carry no information. The cost of an honest signal is what makes it honest.
• Reciprocal. One-way trust is dependency or extraction.
• Witnessed. Trust no one can attest to is unfalsifiable. The act observed by a third party is the act that counts.
• Repairable. Brittle trust shatters at the first failure. Durable trust gets repaired. The repair protocol is part of the asset.
• Over time. Trust accumulates through repetition. No amount of money on the table buys it instantly.

Read those eight to a CISO and you'll get a slow nod. Read them to a CHRO and you'll get the same. Read them to your CFO and you'll get the question that always comes next: can we measure it.

Yes.

The equation

It is not a dashboard score. It is a leak detector.

Trust between two parties at time t is the running accumulation of cost-of-signal × presence × reciprocity × shadow-of-the-future, minus the cost of any betrayal observed along the way.

For an operating audit, the five terms below are enough to find any leaks.

• C — Cost of Signal. How expensive is an honest signal in this domain? When resumes cost hours and reviewing them costs minutes, C is high. When resumes are AI-generated for free and verifying them costs hours, C inverts. Watch this number.
• P — Presence. Co-location, co-attention, and witness. The all-hands at which everyone has a laptop closed has different P than the one where everyone is half-present on their phones. A private promise has different P than a commitment others can attest to.
• R — Reciprocity. Does the exchange go both ways? An employee asked to invest career capital in a company that won't invest in them carries an R near zero.
• δ — Shadow of the Future. Will the parties meet again? One-shot transactions on a marketplace have small δ. Long-term partners have large δ. This is why one-shot encounters are so vulnerable to fraud.
• B — Betrayal. Two independent literatures arrive at the same coefficient. Roy Baumeister's Bad is Stronger than Good surveyed psychology across emotions, feedback, parenting, and memory — and found that negative events outweigh positive ones by a factor of three to five. John Gottman, watching marriages in his lab, arrived at five from the other direction: couples who maintain at least five positive interactions for every negative one stay together; below that ratio, they fail, with predictive accuracy above 90%. The asymmetry is the point. Trust builds slowly. B cuts fast. Repair does not erase B. It metabolizes it. A system without repair lets betrayal accumulate until the relationship fails.

The integral matters. Trust is the area under the curve over time. A marriage, meeting, a quarter, a tenure, a career.

Now run that equation on the analyst's 2:47 AM session.

The cost of producing the synthetic identity was effectively zero. C, on the attacker's side, has collapsed. The cost of verifying it is high and rising. The defender has been priced out of the signal. δ is meaningless: the attacker will not meet this organization again under this name. R is absent. P is a model output, not co-presence. The integrand has gone to zero from four directions at once. The 0.97 is the model lying with precision.

Now run the same equation on the acequia.

The shadow of the future is enormous: the same mayordomos meet next April, and the April after, and the April after that. δ is high. The cost of signal is high: showing up, in the wind, in the heat, with a shovel. C is high. Reciprocity is structural: downstream gets water if upstream cleans the ditch. R is built into the geography. Presence is real: the limpia is co-located, co-attended, physical work alongside neighbors who will see whether you carried your share. P is high. Witness is automatic; every mayordomo is watching. The whole system is its own audit.

Betrayal exists. People have been caught taking more water than their allotted suerte. The protocol exists. The repair exists. And because the repair exists, B does not destroy the system. It is absorbed and processed.

The acequia is what a high-trust integral looks like when it has been running for centuries. The 2:47 AM login is what a zero-trust integral looks like when none of the variables have anything to bind to.

The variable that drops is the variable that tells you where the leak is. Run the same equation on a vendor relationship that has burned you. Or a direct report you used to count on. Or a board member who has gone quiet.

The audit

Eight predicates. Eight questions. Run them on any relationship that matters.

• Load-bearing — If it fails, what falls? Name the downstream outcomes that depend on this relationship. If you can't, the relationship is decorative. Decorative relationships consume calendar without producing returns.
• Relational — Does it live between us? If their staff doesn't know your name, the relationship you describe is not the relationship they would describe.
• Condition — Is anyone still keeping it? A holiday card is not contact. A real exchange in the last ninety days is.
• Costly — Could this be faked for free? If your communication is commodity-priced, it is commodity-trusted. The talking points two other vendors brought yesterday are not signal. They are noise.
• Reciprocal — What goes back? Name what the other side gets from trusting you. If the answer is nothing, you are running an extraction operation.
• Witnessed — Who saw it? Private trust does not survive a job change. If no one outside the dyad would attest to your reliability, you are one reorg from condition zero.
• Repairable — Is the repair built in? The first apology should not be the first hard conversation. Test the channel during a calm period.
• Over time — How long has this been running? Don't spend what you haven't deposited.

Run them on one relationship you know is healthy and one you know is failing. The diagnostic will tell you which is which, and why.

The mayordomos pass all eight without writing them down. That is what centuries of working architecture looks like.

What this lets you do

Locate the leak. When trust falls, the variable that fails tells you where to look. Did C fall? Probably AI-generated noise. Did P fall? Probably a return-to-office or remote-only decision that did not solve for co-attention. Did R fall? Probably a layoff or a pay-and-promotion mismatch. Did δ shrink? Probably short-tenure incentives that made everyone behave like a one-shot player. Did B spike? Something happened. Find it.

Audit your AI initiatives. Pull up the roadmap. For every project, ask one question: does this raise or lower the cost of a trustworthy signal inside the organization? If you cannot answer, you are not measuring the variable that determines whether the project succeeds. If your AI governance tracks model risk and data risk but not trust risk, you are missing a third row in your spreadsheet.

Design interventions that build the working system, rather than burn it. Most efficiency programs reduce C and reduce P. They look like wins on a quarterly dashboard. They are loans. The interest comes due eventually, and it usually comes due during a crisis. Programs that increase friction in the right places, that protect the cost of the honest signal, that preserve the venues of co-attention and co-creation, are not inefficiencies. They are deposits.

Six hundred feet over the Rio Grande, the bridge is steel. The engineers got the math right, and now everyone who crosses it trusts them with their body, every day, without thinking about it. The bridge holds because the math has been written down. The same water passes under that steel and, three hundred miles south, runs into the ditches the mayordomos have been tending for four centuries. No steel. Same river. Same physics. The variables were operating in the river, and in the ditch, and in the night-shift analyst's stack, before any of them had names.

That is the work of Digital Gravity: writing the math down for the forces that were already holding things up.