Roy's safety-first criterion