SENTRY: Deterministic, Intelligent Risk Assessment for IT Change Management

2026-08-21

AI Summary

本文介绍SENTRY平台，通过使用XGBoost和RAG技术替代基于问卷的风险评估方法，提高了IT变更管理中风险评估的准确性、一致性和可审计性。

Abstract

Technology change management in large financial institutions depends on risk assessments that are accurate, consistent, and auditable. In practice, many institutions still rely on self-reported questionnaires. Those questionnaires are subjective, easy to game, and poor at separating routine changes from the ones that later trigger major incidents. This paper presents SENTRY, a risk assessment platform that replaces questionnaire-based scoring with a deterministic machine learning pipeline built from gradient-boosted decision trees (XGBoost) and hybrid retrieval-augmented generation (RAG). The system combines structured operational metadata, application dependency graphs, and historical incident records with a hybrid semantic and lexical search over historical change requests. The retrieval step captures the risk signal in unstructured change request text, then compresses that signal into a single scalar feature before model inference. That design keeps the model deterministic and preserves per-prediction explainability via SHAP values. Evaluated on enterprise-scale change data, SENTRY achieves a ROC AUC of 0.87 and 85% overall accuracy, and it detects high-risk changes at roughly 3.25 times the rate of the existing process. We close by examining the architectural trade-offs behind this design and what they imply for the use of machine learning in regulated change management.

Problem

• risk assessment
• change management
• financial institutions
• self-reported questionnaires
• major incidents

Innovation

• deterministic machine learning
• gradient-boosted decision trees (XGBoost)
• hybrid retrieval-augmented generation (RAG)
• SHAP values
• risk assessment