Digital Trust Is an Orbit, Not a Pillar

For years, trust has been treated as something you can build and certify: one more property to engineer into a system and tick off, assessed alongside accuracy, robustness, privacy and fairness. Whole frameworks are organised this way, from the EU’s ethics guidelines for trustworthy AI to the NIST AI Risk Management Framework, each with its own assessment checklist. There is real value in that, and it has carried the field a long way. But trust is not quite a feature you construct and sign off once: too many variables feed it, and it never holds still. It is closer to an orbit, the path three moving bodies, the model, the person and the organisation, trace together when you keep them in balance.

Executive summary

Most responsible-AI thinking borrows its imagery from architecture: trustworthiness as a set of pillars, or requirements, you build into a system and certify. The major frameworks are organised this way, the EU’s ethics guidelines with their seven requirements and a matching self-assessment list (EU High-Level Expert Group, 2019), and the seven characteristics of the NIST AI Risk Management Framework. Stack them, label them, certify them. The trouble is that real AI systems never hold still. A model retrains. A person withdraws consent. A regulator publishes new guidance. A credential leaks. Each event changes the load on everything else at once, and a stack of static pillars cannot describe a system that is always in motion.

This report offers a different picture, drawn from physics. Digital trust behaves like the famous three-body problem: three bodies pulling on one another, with no neat solve-once answer, wildly sensitive to small nudges, and yet able to settle into a few elegant, stable shapes. The three bodies are the model, the person and the organisation. Trust is not any one of them. It is the orbit they trace together. Three practical consequences follow: trust must be assessed continuously rather than stamped once a year; every honest assessment must say exactly what it covers (which body, which kind of AI, which reader); and the trade-offs between the bodies are not bugs to hide but forces to manage in the open. The Iceberg Framework, developed at iceberg.digital and published at the 2026 IEEE Swiss Conference on Data Science and AI, where it received the Best Paper Award, is one structured way to do exactly that.

From pillars to orbits

The pillar metaphor carries a quiet assumption: that trust is a thing in its own right, a property you can build and certify on its own. More often it is the result of fairness, privacy, governance, explainability and many other forces working together at once, an outcome rather than an input. When trust is treated as an input, the natural and well-meant move is to install a policy for each pillar and expect public trust to follow. It is an easy trap to fall into, and it is one reason careful organisations can do everything on the checklist and still find that trust has not quite arrived (World Economic Forum, 2022).

If trust is not a pillar, what is it? A better metaphor lives in the night sky.

What the three-body problem actually teaches us

In 1885 the King of Sweden offered a prize to anyone who could predict, once and for all, the motion of three bodies pulling on each other by gravity, say a star and two planets. Henri Poincaré won the prize in 1889, but not by solving it. He proved something stranger and more useful: for three or more bodies, no tidy solve-once formula exists. The motion is so sensitive that a tiny difference at the start produces an enormous difference later. Decades on, the meteorologist Edward Lorenz rediscovered the same effect in weather and gave it its famous name, the butterfly effect.

Here is the hopeful half. A system with no clean solution is not the same as pure chaos. Joseph-Louis Lagrange found five special arrangements in which three bodies can travel in formation forever; Jupiter’s Trojan asteroids ride two of them today, and the James Webb Space Telescope parks in another. Mathematicians later found an orbit in which three equal masses chase each other forever along a single figure-eight. A chaotic system, in other words, can still settle into shapes of real elegance, as long as the bodies are kept in the right relation. (For the full history, the Wikipedia entry on the three-body problem is an excellent start.)

That is exactly the right way to think about digital trust. You cannot solve it once and ship it. You watch it, step by step, and you nudge it back toward a stable shape whenever it drifts. Engineers have a name for that step-by-step watching, and we will come back to it: continuous assurance.

The three bodies of digital trust

If trust is the orbit, what are the bodies? There is a clean way to divide any AI deployment into exactly three actors, with nothing left over.

The model is what the AI system does: does it decide fairly, and can it show its reasoning? Its weight in the system comes from how well it performs and how much its mistakes cost. The qualities that make a model trustworthy, fairness, accuracy, robustness, explainability and safety, are the ones the US National Institute of Standards and Technology gathers under the heading of trustworthy AI (NIST, 2023). A single bias the developer never tested for can pull the whole system off course.

The person is the human the system affects: their identity, their privacy, their ability to say yes or no and to be heard when a decision goes against them. This is where consent and the right to a remedy live, and where fairness stops being a number in a report and becomes something an individual actually experiences. It is also where trust is felt, in the everyday human sense of whether you believe a system is competent and on your side.

The organisation is the deployer: the company or institution that puts the system into the world and answers for it. Its weight is made of governance, oversight, transparency and accountability. This is the body that publishes the documentation, signs off on the risk assessment, takes the regulator’s call, and owns the clean-up when something breaks. It carries the system’s standing in the eyes of the public (World Economic Forum, 2023).

Trust is what appears when these three are in a stable arrangement. It is the shared balance point they orbit, and it is never identical to any one of them. That is the whole move: stop trying to build trust directly, and start keeping the three bodies in the relation that lets trust hold its shape.

Enlarge

A quick note on a word that does double duty. validant.ai ships an offering called Digital Trust, alongside AI Fairness & Explainability, and a third, planned offering, Self-Sovereign Identity, for the individual. Each offering is the lens that assures one body. So the word “trust” names both one of the bodies and the felt outcome of all three at once: the offering is a body, and the felt outcome is the orbit.

This is also the why, what and who we lead with on our home page, read from the reader’s side. What asks what your model actually does, and whether it can show its reasoning: that is the model, assured by AI Fairness & Explainability. Who asks who you are and who gets to assert it: that is the person, the work of Self-Sovereign Identity. Why is digital trust itself, the reason any of it is worth doing: not a fourth thing, but the orbit the other two trace, held together at the level of the organisation through the iceberg.digital trust signal. The table below keeps all of it in one view.

The same picture explains failure. Let one body gain too much weight, or push another to the margin, and the orbit stops closing. A model optimised for accuracy at everyone else’s expense; a person whose consent is treated as a checkbox; an organisation whose governance has quietly drifted: any one of these reshapes the whole path, not just its own corner. This is the butterfly effect in plain clothes. A small bias, a leaked credential or a governance gap does not stay local; it perturbs the entire orbit.

Enlarge

Where the gravity pulls: the trade-offs

The three-body picture earns its keep when it makes the tensions between the bodies impossible to ignore. In space, gravity is the only force. In trust systems the pulls are more interesting, because each one is a genuine trade-off between things people value.

• 01Model against person: accuracy versus privacy. A model often gets sharper when it is fed more, and more sensitive, personal data. The two are not always opposed, and privacy-enhancing technologies exist to ease the strain, but the pull is real.
• 02Organisation against person: oversight versus autonomy. Logging, monitoring and the power to investigate are essential for an institution to be accountable, yet every one of them is also a touch on an individual’s autonomy. Good governance respects the person rather than absorbing them.
• 03Model against organisation: speed versus assurance. Engineering teams want to ship; governance teams want to be sure. The healthy answer is neither “ship anyway” nor “never ship,” but a rhythm in which each meaningful model change triggers a proportionate re-check.

Naming these pulls is not pessimism. It is the first step to keeping the configuration stable, because a force you have named is a force you can balance.

Scoping honestly: body, pathway and audience

The three-body idea is the philosophy. In practice, checking whether the orbit is healthy means being honest about what, exactly, you have assessed. Picture three independent dials. Turn one and the other two stay put. A real assessment is a setting on each dial, and often a small range rather than a single notch.

The body is the what: which of the three is under the microscope. Pathway is the kind of system, and it matters because each kind changes the nature of the trust problem. A predictive model raises questions of calibration and group fairness; a generative system raises hallucination and provenance (Ji et al., 2023); an autonomous agent raises the question of who is responsible when a workflow acts on your behalf and gets it wrong. Audience is the subtle one, and the most important to state plainly: the reader changes the wording, never the numbers. A board, an engineer, an affected customer and an external auditor each need a different framing of the same evidence.

Enlarge

The point is honest scoping. Anyone who claims to have assessed “the trustworthiness of AI,” full stop, without naming the body, the pathway and the audience, is selling a slogan, not an audit. It also explains why benchmarks travel so badly: a fairness score tuned for a predictive classifier and written for a regulator tells you almost nothing about a multi-agent system used by the public.

The depth beneath: the four-layer iceberg

If the three-body problem is the honest description of the difficulty, organisations still need a way to bring order to it. That is what the peer-reviewed work behind this article provides. “The Architecture of Digital Trust,” published at the 2026 IEEE Swiss Conference on Data Science and AI, sets out the Iceberg Framework: a four-layer, socio-technical model that treats trust as a layered property of a system, most of it hidden below the surface like an iceberg (Glinz, 2026). The layers do not sit inside one body; they cut across all three. That is precisely why no single offering can deliver trust on its own.

Across these layers the framework defines ten constructs and 127 individual trust cues, drawn from a careful synthesis of research across several fields. The exact numbers matter less than the lesson they carry: trust is never a single score. It is a textured reading across many signals whose importance shifts with the audience and the kind of system. The bodies tell you what to look at; the layers tell you how to make the orbit measurable.

This is also where validant.ai’s position matters. We operate as an independent assessor, closer in spirit to a credit-ratings agency than to a vendor grading its own homework. Independent, repeated assessment is the real-world version of how astronomers handle the three-body problem: you cannot solve it once, but you can compute it step by step, and you can catch drift early enough to correct it.

What changes if you accept the orbit

Three things change in practice once you stop treating trust as a pillar.

• 01Continuous assurance replaces the annual stamp. A trust assessment is not a certificate you frame on the wall. It is a running calculation. Any change to a model, a credential or a policy is a nudge, and nudges travel through the whole system.
• 02Scope becomes something you state up front. Every serious trust claim should name its body, its pathway and its audience. A combined report can then walk the bodies in turn and show the whole orbit, instead of holding up one body and hoping you mistake it for the system.
• 03The trade-offs become visible and negotiable. Accuracy against privacy, oversight against autonomy, speed against assurance: these are not failures of design. They are the forces that shape the orbit, and naming them is how you keep the shape.

In one line

The model, the person and the organisation trace one shared orbit, and that orbit is trustworthy AI. An assessment is a location in the body, pathway and audience space, and a combined report walks the bodies to show the whole orbit at once. The Iceberg Framework is one structured way to find where you are in that orbit, and to catch drift before it becomes chaos.

“Trust is not a thing you build. It is the shape your system traces when the model, the person and the organisation are in the right relation, and you keep them there.”

Digital Trust Is an Orbit, Not a Pillar

Sources and further reading