---
title: "SENTRY: Deterministic, Intelligent Risk Assessment for IT Change Management"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.21203v1"
permalink: "https://feed.astralor.com/items/itm_bdac0884ed712696501fa5d0"
published: "2026-08-21T15:18:21.000Z"
score: 72
channel: "tech"
tags: ["arXiv","IT Change Management","SENTRY","XGBoost","Explainable AI","Retrieval-Augmented Generation"]
---

# SENTRY: Deterministic, Intelligent Risk Assessment for IT Change Management

## AI commentary

> This paper is worth attention because it embeds RAG and XGBoost into regulated processes in a restrained, auditable way, rather than piling on large models. It offers a practical reference for fintech, IT operations leaders, and risk teams, showing a non-over-engineered approach that significantly improves risk detection.

## At a glance

IT change management in large financial institutions relies on risk scoring, but traditional questionnaire-based assessments are subjective, easy to game, and poor at distinguishing routine changes from high-risk ones. This paper presents SENTRY, a platform that replaces questionnaire scoring with a deterministic machine learning pipeline built on XGBoost gradient-boosted decision trees and hybrid retrieval-augmented generation (RAG). The system integrates structured operational metadata, application dependency graphs, and historical incident records, and uses hybrid semantic and lexical search over historical change requests. The retrieval step captures risk signals from unstructured change text and compresses them into a single scalar feature before model inference, keeping the model deterministic and enabling per-prediction explainability via SHAP values. Evaluated on enterprise-scale change data, SENTRY achieves a ROC AUC of 0.87, 85% overall accuracy, and detects high-risk changes at roughly 3.25 times the rate of the existing process. The paper also discusses architectural trade-offs and implications for machine learning in regulated change management.

## Key points

- SENTRY replaces questionnaire-based risk scoring with XGBoost and hybrid RAG in a deterministic ML pipeline
- Compresses unstructured change request text into a scalar feature via hybrid retrieval, preserving explainability
- Achieves ROC AUC 0.87 and 85% accuracy on enterprise-scale data, with 3.25x high-risk detection rate
- Examines architectural trade-offs for ML in regulated change management

## Full text

Technology change management in large financial institutions depends on risk assessments that are accurate, consistent, and auditable. In practice, many institutions still rely on self-reported questionnaires. Those questionnaires are subjective, easy to game, and poor at separating routine changes from the ones that later trigger major incidents. This paper presents SENTRY, a risk assessment platform that replaces questionnaire-based scoring with a deterministic machine learning pipeline built from gradient-boosted decision trees (XGBoost) and hybrid retrieval-augmented generation (RAG). The system combines structured operational metadata, application dependency graphs, and historical incident records with a hybrid semantic and lexical search over historical change requests. The retrieval step captures the risk signal in unstructured change request text, then compresses that signal into a single scalar feature before model inference. That design keeps the model deterministic and preserves per-prediction explainability via SHAP values. Evaluated on enterprise-scale change data, SENTRY achieves a ROC AUC of 0.87 and 85% overall accuracy, and it detects high-risk changes at roughly 3.25 times the rate of the existing process. We close by examining the architectural trade-offs behind this design and what they imply for the use of machine learning in regulated change management.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_bdac0884ed712696501fa5d0