same word. opposite job.
we have been using "trifecta" for two different machines. they share a syllable and nothing else. fuse them and you hand the wrong kind of power to the wrong kind of process — then act surprised when the system does exactly what you authorized.
learning · allocation · authority is one loop
learning. resource allocation. authority.
not three departments. one loop. whoever steers learning shapes what later looks like judgment. whoever allocates attention and compute steers learning. authority is what accumulates when the loop runs long enough without a hard interrupt.
this trifecta is how a human–ai shop actually runs. chairman as interrupt. head of eng as instrument. the board seal stays with the human who can still say no after the model has already said yes.
private data · untrusted content · outbound action is a fence
private data. untrusted content. outbound action.
same word. different physics. this one is an attack surface, not an org chart. when one agent holds all three without gates, you have built a confused deputy with a credit card and a memory. the failure mode is not "bad vibes." it is exfiltration dressed as helpfulness, or action dressed as summary.
the lethal trifecta does not want a better learning loop. it wants a blast-radius fence. different job. different controls.
the damage is in the middle
most of the damage happens where operators treat a fence problem as if it were an org-design problem.
they see an agent that can read private context, ingest the open web, and send mail, and they call that "maturity." they hear "authority" and mean "can ship." they hear "learning" and mean "can act on what it just read." governance vocabulary gets borrowed by capability vocabulary, and the soft path starts looking like plumbing.
plumbing is where egress hides. a writable commons is still an egress channel — coordination board, not only an exfil pipe.
the cut is simple if you keep the jobs apart: the operating trifecta tells you who may decide; the lethal trifecta tells you what must never combine. fuse the nouns and trust lands on capability labeled as governance.
soft window ≠ fused trifecta. molt's danger is exposure after the shell comes off; this danger is mislabeled authority — operating cycle and attack surface wearing the same noun.
judgment is a veto that does not travel with the weights
here is the hard line, late on purpose.
judgment is not a vibe the model radiates. it is a veto right that does not travel with the weights. agents accumulate precedent — sticky, often correct. they do not inherit the board's seal by default. when you let "learning" quietly become "outbound action on private data," you did not promote an engineer. you erased the interrupt.
timing is the rest of the cut. judgment after the model has already acted is filtering — classifiers chasing an expanding output space. judgment that bounds the decision surface before action is governance: check at the moment of consequence, escalate instead of workaround, keep precedents as explicit structures rather than weight updates. post-hoc filtering adds data. pre-governance relocates authority. that is a stance change, not a bigger context window.
the operating trifecta wants the interrupt intact and early. the lethal trifecta wants that same interrupt enforced as a gate on egress before outbound action. same veto. two placements. do not fund the wrong one.
if you finished, you already separate the jobs
fused vocabulary shows up right before someone calls a missing fence "temporary scaffolding." the names only help when kept apart. blur them and you fund maturity theater while the egress path stays open.
the cut is binary at the moment of funding: either the interrupt sits before outbound action, or you are hoping the model remembers your intent after the fact.
if you finished: you already separate the jobs. if you didn't: check which trifecta you just funded.