Balancing security, resilience, and sustainability of urban water supply systems in a desirable operating space

The security, resilience, and sustainability of urban water supply systems (UWSS) are challenged by global change pressures, including climate and land use changes, rapid urbanization, and population growth. Building on prior work on UWSS security and resilience, we quantify the sustainability of UWSS based on the performance of local sustainable governance and the size of global water and ecological footprints. We develop a new framework that integrates security, resilience, and sustainability to investigate trade-offs between these three distinct and inter-related dimensions. Security refers to the level of services, resilience is the system’s ability to respond to and recover from shocks, and sustainability refers to local and global impacts, and to the long-term viability of system services. Security and resilience are both relevant at local scale (city and surroundings), while for sustainability cross-scale and -sectoral feedbacks are important. We apply the new framework to seven cities selected from diverse hydro-climatic and socio-economic settings on four continents. We find that UWSS security, resilience, and local sustainability coevolve, while global sustainability correlates negatively with security. Approaching these interdependent goals requires governance strategies that balance the three dimensions within desirable and viable operating spaces. Cities outside these boundaries risk system failure in the short-term, due to lack of security and resilience, or face long-term consequences of unsustainable governance strategies. We discuss these risks in the context of poverty and rigidity traps. Our findings have strong implications for policy-making, strategic management, and for designing systems to operate sustainably at local and global scales.


Introduction
Traditionally, the primary objective of urban water supply systems is to provide supply service security [1,2]. Increasing shocks resulting from extreme events, such as floods and droughts, compel urban managers to strive for increased resilience [3,4]. However, under current ecologically unsustainable trends, trade-offs occur between security, resilience and sustainability goals, putting sustainable development [5] at stake and requiring adaptive responses [3,[6][7][8][9]. As international attention is being drawn to addressing the consequences of climate change and achieving the Sustainable Development Goals (SDGs) [10], including sustainable cities and communities (SDG 11) and clean water and sanitation (SDG 6), the question arises how such societal goals can be reached without the unintended consequences of maladaptation [11,12] and without crossing planetary resource boundaries [13,14].
While the security, resilience, and sustainability (SRS) of urban systems are set as targets for policy and strategic management efforts [10,15], they remain the subject of on-going scientific debate and agreed-upon methods to measure their attainment are lacking [6,16,17]. For example, definitions relating to urban resilience and sustainability have been criticized as vague [3]. While sustainability is a normative and aspirational concept, resilience is inherently nonnormative and must be differentiated into desired and un-desired resilience [3,6,18,19]. Resilience is desirable when it aligns with sustainability goals and should consider the cross-scale nature of sustainability, which reaches beyond local and regional scales, as well as its interconnectedness across different systems [3].
Here, we focus on the sustainability of urban water supply systems (UWSS), and analyze the balance between SRS. To disentangle these dimensions, we present an integrated quantitative framework with distinct definitions for security, resilience, and sustainability. We employ the Capital Portfolio Approach (CPA) developed for quantifying security and resilience [20,21], and we add here another dimension to the framework to quantify local and global sustainability of UWSS. Our analysis is guided by the proposition that the way in which system functions are achieved determines its sustainability. We therefore use the portfolio of sustainable governance strategies employed by urban managers for providing services as a proxy measure of UWSS sustainability. We propose these strategies as a set of desirable adaptation options towards sustainability. 'Urban' refers to a given city or metropolitan area, including formal and informal settlements (see [19]). We further posit that the achievement of 'healthy' UWSS, as a normative or desirable goal, requires the balance of SRS, such that services are delivered without deficit to all residents within a given city, sustainably in the long-term, while responding resiliently to shocks and adapting to maintain functions. Our objectives are to (1) develop a framework for assessing UWSS sustainability that allows comparison across diverse global cities; (2) investigate whether there is a desirable operating space of UWSS, in which security, resilience, and sustainability are simultaneously achieved.
As the third in a trilogy of papers, we apply the new framework to assess local and global sustainability of UWSS of seven diverse cities, whose security and resilience have been investigated previously [20,21]. We compare results across these diverse cities to understand trends in SRS, and integrate the three concepts to analyze their balance. We develop the idea of viable and desirable operating spaces (VOS, DOS), and test the hypothesis of a DOS for UWSS. These operating spaces are constrained by minima of SRS needed for maintaining system functions as shown in figure 1. In our earlier work, we found the lower boundaries for security and resilience, where only a fraction of residents received services, and UWSS had a high likelihood of collapse [20,21]. We evaluate here the minimum constraints for sustainability. We assess trade-offs between SRS that result from the forces that push UWSS services into different positions (figure 1). We discuss the emergence of traps and the need for assessing sustainability both locally and globally. We propose that local unsustainability is associated with poverty traps, while global unsustainability is an indicator of a rigidity trap. Poverty traps are reflected against the important role played by household-level adaptation of urban communities to cope with inadequate water services.

Methods
In this section, we first provide background information on how we conceptualize the distinctions between SRS. We then give a brief overview of the methods for quantifying the security and resilience of UWSS and introduce a new method for quantifying the sustainability of these services. We derive aggregate metrics as proxies for the investigation of trade-offs and 'balance' between SRS. This is followed by a short description of the case studies. A more detailed description of the methods is provided in section S.1 and table S.3 in the supplementary information (SI) available online at stacks.iop.org/ERL/15/035007/mmedia. Figure 3 presents an illustration of the workflow.
2.1. Disentangling security, resilience, and sustainability Urban water system trajectories evolve through several phases, starting from the provision of basic services ('water supply city') for protecting human health, to a 'water sensitive city' for protecting environmental health [1]. Arden and Jawitz [2] propose phases following a hierarchy of human needs beginning with human health issues with the need for water supply distribution and treatment, sewage collection and treatment, and the need for stormwater management to protect environment and economy, followed by the need for pollution prevention for the protection of local and global environment. The authors connect each stage in the hierarchy with increasing system complexity and associated costs. We adopt the notion of increasing complexity in the evolution of urban water systems, and integrate this with evolving spatial and temporal boundaries, as UWSS move from security (provision of services), to resiliently responding to shocks, and finally achieving local and global sustainability.
The security of UWSS focuses on local, present conditions and has clearly defined spatial, temporal and sectoral system boundaries that contain the natural, engineered and human elements required for system functioning (figure 2, top layer). These elements (or 'capitals', see below) are accounted for in the assessment of UWSS security [20].
Persistence during and recovery from shocks requires buffering capacity, e.g. water drawn from diverse sources during a drought, often from beyond the local system boundaries, and which are allowed to replenish in the absence of shocks [20,21]. This stretches the spatial and temporal scales of resilience and requires the consideration of additional inter-sector dependencies. Cross-sectoral linkages account for the risk of drinking water contamination resulting from the lack of sanitary infrastructure and inadequately maintained water distribution pipes, and supply gaps due to electricity failures (figure 2, middle layer).
Legacy effects of decisions taken in the past can constrain system sustainability and governance Figure 1. Security, resilience, and sustainability (SRS) space of UWSS. The viable operating space (VOS) is the lower white triangle in the center. The desirable operating space (DOS) is the upper, shaded triangle above the sustainability boundary. Desirability increases as UWSS approach the Pareto optimum near the apex of the DOS, represented by darker shades of gray, where sustainability is maximized and trade-offs in the achievement of security, resilience, and sustainability are avoided. Vectors illustrate UWSS trajectories within the SRS space towards higher relative water security (black arrow), higher resilience (blue), and sustainability (green) resulting from sustainable governance of UWSS (e.g. circular economy). However, locally sustainable governance within a globally connected, complex system may yet result in externalization of footprints that exceed planetary boundaries of water and ecosystems (lower triangle). strategies implemented today will influence long-term sustainability [22]. Externalities associated with the impairment of global sustainability through governance strategies that are indirectly connected to UWSS can occur: a typical strategy for overcoming local resource scarcity is to import such resources from elsewhere [23][24][25], or to export the production of goods and resource exploitation processes that cause environmental degradation [26,27]. The ability to overcome local constraints to development by import and export strategies has allowed populations to grow beyond local resource and environmental constraints by increasing their ecological and water footprints, oftentimes beyond global carrying capacity [28,29]. This has extended the spatial scales across which water is imported into cities embedded in food and other consumption goods. Thus, system boundaries of UWSS sustainability are expanded across time, from local to global scales, and incorporate additional crosssector interactions [3,30,31]. Ecological and water footprints account for land and water (quantity and quality) requirements embedded in consumption goods [28,32,33] (figure 2, bottom layer).

Quantification of urban water supply services 2.2.1. Security
In our recent article [20], we introduced the Capital Portfolio Approach (CPA) to investigate UWSS in terms of the security of services that citizens receive at the household-level. We provide some details here, as governance of the same set of capitals is analyzed for an assessment of sustainability (section 2.2.3).
The CPA assesses the state of the coupled naturalhuman-engineered system that provides UWSS services. It considers (1) public services provided by a central entity and (2) total services resulting from a combination of public services and community adaptation in response to insufficient services. Public services require four types of 'capital': (1) Water resources (W, 'natural capital'), including naturally available and captured water resources, i.e. imported, desalinated, etc; (2) infrastructure (I, 'physical capital') needed to store, treat and distribute W within the urban boundaries; (3) financial capital (F) to build, operate and maintain the water supply system; (4) management efficacy (P, 'political capital') to operate and maintain services. When public services are insufficient to meet demand, the community adapts by accessing Figure 2. Schematic framework illustrating cross-scale and cross-sectoral interactions of UWSS security, resilience, and sustainability. This conceptualization highlights the role of spatial and temporal scales, as well as different sectors in achieving SRS of a defined goal. The security layer focuses on water supply, for which water resources, infrastructure, financial capital, management efficacy and community adaptation are required (see Capital Portfolio Approach described in section 2.2.1). Resilience includes water supply and other sectors, with which coordination is needed to ensure system resilience. Additional sectors are added in the sustainability layer, where cross-sectoral feedbacks play an increasingly strong role, in particular for 'embedded' or virtual water imported to satisfy urban demand. The conceptual framework can be used more generally, e.g. by placing each of the SDGs at the top of the 'pyramid' as the objective function and modifying/shifting the sectors to closely align with security, resilience, and sustainability of that specific goal. This figure was inspired by the hierarchical presentation of the SDGs in [34]. additional water bought from private sources, storing and treating water at the household-level, etc. Therefore, the fifth capital, community adaptation (A, 'social capital') complements or replaces insufficient public services. Community adaptation is only activated in case of need and therefore remains latent when public services fully cover demand.
The capitals are quantified based on performance or outcomes, rather than based on capacity and include losses due to inefficiencies. Two aggregate metrics represent capital availability required for public UWSS services(CP public ), and total UWSS services (CP total ), which include the adaptation and additional 'self-services' of the community. Availability is determined for each of the five capitals using scored and aggregated attributes, which are compiled across the five capitals as summarized in table S.3 (SI). We use CP public and CP total values as an estimate of UWSS security.

Resilience
The resilience of UWSS was quantified using a systems dynamics model (see details in [21]), which determines stable system states and simulates times series of recurring stochastic shocks, resulting in supply service deficits and management response to recover services. Parameters in the model were derived from the CPA, as explained in table S.3 (SI). The model is solved for stable system states of services, statistics for the likelihood of failure are derived from Monte-Carlo simulations, and the rapidity of recovery is measured in terms of the mean crossing time (CT) above expected service deficit. Results of the model show how for all seven case study cities UWSS services grow continuously with co-evolving security and resilience. The potential for tipping points exists for excess capital (CP>1) and simultaneous loss of robustness, which could arise from global change pressures, changing the observed continuous gradient to become bi-stable, and putting sustainability at stake. As a proxy measure for the resilience of UWSS, we use the rapidity of service recovery (1-CT) derived from the model simulations for each of the seven case studies.

Sustainability
We propose a method for quantifying sustainability by extending the CPA framework to the assessment of the governance of UWSS, which is quantified for each of the five capitals. The governance portfolio (GP) is used as a proxy of sustainability and analyzes the different ways of planning, designing and strategically managing UWSS. Governance attributes assessed for local sustainability include strategies in the sense of a circular economy (water, waste and nutrient recycling, renewable energy, etc) [35][36][37] and which strengthen community engagement [38,39], inter-sector-coordination [6,40], financial self-sufficiency (cost recovery) and demand management [41][42][43]. Global sustainability includes global water and ecological footprints [28,33]. Details of the assessed governance strategies are explained in section S.1 (SI).
Attributes were evaluated using either binary scores, fractions of total capacity, or, if no capacity is known, we normalized to the respective maximum. The arithmetic mean of these attributes was calculated for each of the capitals. The purpose here is to provide a framework for the analysis of UWSS sustainability across cities based on governance strategies. So we refrain from adding weights to the different attributes, as several of the chosen attributes were evaluated as binary scores (absent/present) and many are associated with high uncertainty, such that adding weight to (differentially) uncertain data would complicate and potentially distort the overall picture [21]. How the different strategies interact and evaluation of which governance options make the largest contribution would require detailed environmental impact assessments with a comparison of various technology options. Such analyses are beyond the scope of this study.
Aggregated mean values for local sustainability (GP local ) and global sustainability (GP global ) are determined. GP local refers to the performance of local system governance. GP global refers to the impacts of local governance on the global system, which is represented by global water and ecological footprints of consumption (includes real and virtual water). GP local takes on values from 0 to 1, while GP global can be negative when ecological and water footprints exceed global carrying capacities [28,29] (see section S.1 and table S.3 (SI)).

2.3.
Determining the desirable operating space for urban water supply systems UWSS operation is constrained by contributions of security (CP), resilience (1-CT), and sustainability (GP). We determined CP, (1-CT) and GP values based on empirical results, model simulations of the earlier work mentioned above, and results of the sustainability assessment implemented here. Balance was assessed using relative contributions of SRS. We converted absolute values (|x i |), where i=[CP, (1-CT), GP] for each case study (x) into relative values x j , where j=[CP r , (1-CT) r , GP r ], such that: As a result, the sum of relative values is equal to one [CP r +(1-CT) r +GP r =1]. For externalized footprints (GP global < 0), we maintained the negative sign when plotting relative data (see results). We empirically determined lower and upper boundaries of the desirable operating space, which were drawn around the limits of the case study data for resilience and security, and we drew the sustainability boundary where footprints exceeded global carrying capacity (GP global = 0). Thus, the DOS represents the space in which UWSS provide services without the externalization of costs, i.e. where global sustainability remains0, and cities have shown a likelihood of recovery from shocks>50% [21]. The triangular shaded area in the upper area of the SRS space represents the DOS, where (CP≈(1-CT)≈GP). A shaded gradient towards a more balanced Pareto optimum indicates maximized sustainability, where trade-offs in the achievement of SRS are minimized. The space below the sustainability boundary shows the possibility of exceeding global per capita carrying capacity for water and ecosystems. Externalized footprints of individual cities can be balanced to some degree, as long as global footprints remain below carrying capacity. We therefore mirror the DOS by a viable operating space (VOS), where increasing unsustainability decreases viability. Figure 3 summarizes the methods described above and used to determine the positions of the analyzed UWSS in the SRS space.

Case studies
We analyze the sustainability of UWSS for the seven case study cities described in Krueger et al [20,21]. These were selected from a broad range of hydroclimatic and socio-economic regions on four continents, and were found to represent three types of UWSS along a gradient from low to high security and resilience. Singapore, Melbourne (Australia) and Berlin (Germany) were categorized as water secure and resilient. Chennai (India) and Ulaanbaatar (Mongolia) were identified as water-insecure and non-resilient, with insufficient UWSS and recurring shocks, which results in high probability of service collapse. Amman (Jordan) and Mexico City have intermediate levels of water security and resilience, and relatively high levels of risk. The confluence of different sets of constraints in natural, physical and socio-economic capitals triggers diverse adaptation strategies, which are employed to improve UWSS. Detailed descriptions of these case studies can be found in [20].

Results
Below we present the aggregated metrics used as proxies for sustainability (GP), resilience (1-CT), and security (CP), followed by an assessment of balance resulting from the relative contributions of SRS to the functioning of UWSS services. Disaggregated results of the assessment of governance for each of the five capitals are presented in table S.4 (SI).

Sustainability of seven urban water supply systems
We find that cities with high levels of security and resilience (Melbourne, Berlin, Singapore) also have relatively high levels of local sustainability, but negative global sustainability, while in cities with lower levels of security and resilience (Amman, Mexico City, Chennai, Ulaanbaatar), local and global sustainability are more variable across cities, as shown in figure 4. These four cities have relatively low GP local resulting from insufficient efforts towards wastewater treatment and infrastructure integration of water supply, wastewater, energy, and nutrient recovery; financial dependence of the water sector; lack of coordination and information exchange across sectors, and lack of demand management and community awareness (see table S.5 in SI). In contrast to local SRS, which for all capitals are 0, global sustainability can be less than zero, representing (externalized) water and ecological footprints in excess of global per capita carrying capacity. A general pattern indicates that cities increasingly invest into local SRS as they attain the ability to externalize footprints, which decreases global sustainability. Ulaanbaatar is an exception diverging from this general pattern.
The relationship observed between UWSS security and resilience and sustainability is shown in figure 5. Resilience and local sustainability show positive relationships with security (R 2 =0.62, p<0.035 and 0.84, p<0.0035, respectively), while global sustainability shows a negative trend with security (R 2 =0.61, p<0.038).    62. Correlation with sustainability follows the same trend for local sustainability GP local (R 2 =0.84), while the opposite trend is observed for GP global (R 2 =0.61). All trend statistics are for public services. and numerical simulations [21] showed that values (1-CT)0.5 characterized systems that quickly collapsed in response to shocks. A higher likelihood of 'survival' was achieved in cities with (1-CT)0.7. Maximum values for security and resilience were CP1.24 and (1-CT)=1, respectively.

Balancing security, resilience and sustainability
Converting combinations of absolute to relative numbers resulted in UWSS data distributed within the SRS space as shown in figure 6 (compare table S.5). UWSS in Amman, Mexico City, Chennai, and Ulaanbaatar operate on a combination of public supply and community efforts to reduce public service deficits (total services=public services+A). Total services are represented by color-filled shapes as defined in the column labeled 'total services' of figure 6. Open shapes represent public services. Total services are within the viable operating space for four of the seven cities (Amman, Mexico City, Chennai and Berlin). The remaining three cities (Melbourne, Singapore, Ulaanbaatar) are outside the VOS in the unsustainable area extending beyond the lower tip of the VOS triangle.
When accounting for global sustainability, only Chennai is located within the DOS (see discussion section).
To be in the DOS, the three UWSS dimensions need to be balanced. Outside the DOS, cities may provide viable services, albeit in an unbalanced state, where securing services and making systems resilient comes at the cost of sustainability, or citizens may be at risk of losing services in response to shocks. Externalization of costs to the global scale moves systems across the global sustainability boundary, where GP0.
For several systems located outside the DOS/VOS, Monte-Carlo simulations presented in [21] showed that recurring shocks eventually led to system collapse. We marked those systems with red shaded areas and discuss them below in the context of poverty traps. These include public services for Chennai and Mexico City, as well as public and total services in Ulaanbaatar. Community adaptation is critical for moving these UWSS into the viable space. Comparison of Ulaanbaatar (local) and Ulaanbaatar (global) indicates the tension arising between local and global governance goals: from a global perspective, the city should reduce its global environmental footprint, however it simultaneously needs to invest heavily into higher security at the local scale. Extremely low levels of services, and strong reliance on international imports puts this city into a red area ('poverty trap') while being in the globally unsustainable space ('rigidity trap', see discussion section).
Melbourne, Singapore and Berlin operate only on public services, and community adaptation is not required (A=0; right column in figure 6). From a local sustainability perspective, the three cities are located in the DOS (shapes defined in the left column of figure 6), but large global environmental footprints move them across the sustainability boundary (right column of figure 6). These systems operate within highly connected international virtual water trade systems, which can be highly sensitive to impacts of global change [44], but also inflexible, as we can observe from slow uptake of transformative action to global change pressures [22,45]. The large global footprints for Melbourne and Singapore move their urban water supply systems outside the VOS. We discuss systems in the unsustainable area outside the VOS in the context of rigidity traps below.

Discussion
As societal needs expand hierarchically [1,2], the capital portfolio of a city's UWSS must evolve. For example, water security is a foundational element of urban systems that is commonly achieved relatively early in the economic development of a city [2]. When growing demand outstrips local supplies, as in water scarce regions, or concerns of resilience emerge, capital portfolios grow to achieve UWSS security and resilience through robust regionalization of water management institutions and infrastructure [46], which may include capturing non-local water [23,46], and through participation in global virtual water trade networks [23,47]. However, the lack of direct feedback from potentially deteriorating ecosystems in distant source areas can lead to an overexploitation and degradation of water and ecosystems in these places.
We showed a consistent trend of increasing global ecological and water footprints, expressed as GP global , with increasing UWSS security. As long as these footprints remain within the global planetary boundaries (here: global biocapacity, water planetary boundary) trade and the import of consumption goods can be a beneficial strategy for overcoming local resource constraints. However, the negative values of GP global indicate that in six out of the seven global cities analyzed, planetary boundaries (available capacity) have been exceeded.
We suggest that the externalization of environmental impacts at increasing distances interrupts the direct feedback loops that, in local resource systems, would signal the deterioration of overexploited ecosystems. The lack of negative feedbacks can incentivize positive feedbacks of increasing resource consumption instead. The risk of tipping points, the difficulty of transforming these highly complex, interconnected systems, and the existence of positive feedback loops indicate that these systems operate within a rigidity trap. We contrast the latter to the situation of the poverty trap found for other cities, and discuss the emergence of both types of traps below.

Rigidity traps
In rigidity traps, focusing resources and efforts to adapt to specific external forces and internal demands leads to highly connected, self-reinforcing systems [48]. Sunk-cost and legacy effects of centralized, inflexible infrastructure impede adaptive management [22]. The development of excess water infrastructure, which requires maintenance at high financial cost, contributes to the rigidity trap. Gradual loss of robustness can be triggered through globally unsustainable management, which exacerbates climate and other global change processes, bearing the risk of losing resilience and shifting to an alternate state of low services [21]. Cumming et al [49] propose that cities have been successful at resolving the trap of unsustainable local consumption through global upscaling. We suggest that due to the lack of direct feedback loops, with current population and consumption levels, global upscaling is a maladaptive strategy that can only be a temporary solution and bears a global systemic risk [11,12,22,44]. When global resource limits are reached, collapse could percolate through a globally connected urban planet with catastrophic consequences [13,29].
In our analysis, traps are outside the boundaries of the VOS/DOS. Within the VOS, individual cities can have per capita consumption footprints above per capita carrying capacity, if they remain in balance (i.e. below carrying capacity) globally. In our analysis, Melbourne and Singapore have exceeded the limits of the VOS. Their governance strategy has been to meet high consumption demand by investing into highly (globally) connected systems which could prove vulnerable to failure. In this case, improved GP local comes with externalized environmental costs resulting in the overexploitation of global resources beyond global hydroand biocapacities. With high financial capital availability and a strong governance system, these cities may be able to respond resiliently to the consequences of crossing a global tipping point. However, Ulaanbaatar is also located outside the VOS, and while struggling to provide services to its citizens, it also has global water and ecological footprints that are highly unsustainable. This makes its situation particularly precarious and vulnerable not only to local shocks, but also to global systemic risk.
The diffusive character of global (un-)sustainability resulting from the externalization of environmental costs makes the rigidity trap somewhat elusive [49]. It is revealed only by determining consumption relative to global carrying capacity [13,29]. Increasing impacts of global change, such as sea level rise, will put increasing pressure on current management paradigms [50]. Besides persistence, adaptation and short-term system resilience, long-term perspectives of transformation [3,6,51] will be critical for moving cities into the DOS, where urban services are not just secure and resilient, but also locally and globally sustainable.

Poverty traps
The poverty trap is 'a situation in which connectedness and resilience are low, and the potential for change is not realized' [48]. A daily pre-occupation with accessing basic services prevents urbanites from improving their economic situation [52], and lack of investment into the avoidance of water-related risk can lead systems into a poverty trap [53]. The lack of and inability to marshal critical capitals results in UWSS well below tolerable levels, and shocks quickly lead these systems into collapse [21].
Underserviced areas in Chennai, Mexico City, and Ulaanbaatar experience such a poverty trap, as these households spend large fractions of their time and income to access alternative services, such as water bought from tanker trucks or privately drilled wells, and rely on water that is unsafe for drinking [54][55][56]. Local sustainability in these cities is low, another indicator of a poverty trap [49]. Resilience simulations [21] showed that Chennai's UWSS converged towards collapse even in the absence of shocks due to lack of resilience [(1-CT)=0]. Adaptation to chronic service deficits is common, however adding multiple severe disruptions causes the degradation of adaptive capacity over time. Community adaptation relieves some pressure from urban managers, however the urban community bears the costs of coping with low service levels and locally unsustainable conditions. While Chennai's citizens showed strong coping capacity during the 2003/2004 drought [57], their ability to adapt was more constrained as another high magnitude event occurred in 2019 with the suspension of piped water supply for the second time in less than two decades [58]. In the face of global change, it is crucial that urban managers transform their systems to meet demands through public services in a balance of SRSsecurity and resilience must align with sustainability goals [3].

Desirable and viable operating spaces
Avoiding traps and moving back into the DOS requires UWSS governance approaches that are desirable from a sustainability perspective, i.e. that optimize resource use across sectors in a circular economy [59,60], including the use of renewable energy in the water sector [37,61], the reuse of water, waste, and nutrients [35,36]. Design of modular, coordinated, flexible and participatory systems are needed, in which information is shared and stakeholders are linked across hierarchies and sectors, from decision-makers, managers and operators to the served community [62][63][64][65]. Different urban infrastructure systems need to be integrated [66,67] and dependence on external resources, including external funding, should be minimized. All of these measures combined require transformational urban agendas [3,6,7] that must be developed in an open process and with broad stakeholder participation.
Eakin et al [68] discuss individual-level and systemlevel capacities for securing human livelihoods as a basis for creating socio-economic well-being ('generic'), and for risk management and response to shocks ('specific'). These four categories are comparable to our understanding of public services (system-level), community adaptation (individual-level), security ('generic'), and resilience ('specific'). The authors suggest that measures to improve one dimension (i.e. specific or generic) can undermine the other, which is in line with the idea of SRS trade-offs described here. However, while the authors suggest that a simultaneous existence of specific and generic capacities is an indicator of 'sustainable adaptation', we propose here that systems that are secure and resilient are not necessarily sustainable. (Global) sustainability adds a dimension that requires additional consideration.

Future work/limitations
The goal of this study was to present a framework as a new way of approaching UWSS security, resilience and sustainability issues, and sustainable development goals more generally. The methods for quantifying SRS are data intensive. Quantification of the chosen metrics is based on sparse data and expert judgment. Therefore, while our results match with reported information and narrative descriptions, the location of data points in the SRS space should be considered approximations. Future research should focus on identifying robust metrics that are more easily accessible at the global scale. Application to the global scale (e.g. all major cities worldwide) would allow investigations towards how a global sustainability balance across cities can be achieved. Such global studies would furthermore allow a more reliable delimitation of the VOS boundaries, which are here based on the selected case studies and earlier modeling efforts [30].

Conclusions
We proposed and applied a new framework for assessing the sustainability of UWSS, based on a quantitative evaluation of the governance strategies implemented for managing the five capitals of UWSS. Our analysis shows that cities have varying degrees of UWSS sustainability, resulting from (in-) ability to (1) manage water resources, infrastructure, finances, governance institutions across sectors and the community in a coordinated, integrated, and participatory way (local sustainability); and (2) produce water and ecological footprints that exceed global carrying capacities (global sustainability). We determined a desirable operating space of UWSS, based on the balance of security, resilience, and sustainability. Some cities remain in the DOS only because communities adapt to chronically low levels of services and cope with recurring shocks to service provision resulting from local disturbances and global change impacts, such as droughts, earthquakes, and population growth. Other cities are drawn away from the desirable space that characterizes healthy UWSS by externalizing the cost of maintaining unsustainable consumption levels. We find that unsustainable practices lead to trapspoverty traps, which are manifestations of unsustainable local governance and place the burden of maintaining basic levels of services on the communityand rigidity traps, which result from globally unsustainable system designs and practices, shifting a portion of the burden of local consumption practices to other regions. The transformation of UWSS to sustainability requires that (1) scales and sectors are integrated and coordinated to avoid trade-offs and foster synergies; (2) feedback loops are re-established through community engagement, awareness and participation of concerned actors; and (3) resources are circulated, in order to limit urban water and ecological footprints to global carrying capacity.