Sixty Models, No Registry, and a Pickle File
Brightline Retail runs 60 production models across fraud, demand forecasting, pricing and recommendations, supported by 4 platform engineers and 22 data scientists. Deployment means exporting a notebook to a shared VM and adding a cron entry. There is no model registry and no model card. Approval is a Slack message from the analytics director.
An audit found that a pricing model retrained by a contractor was uploaded as pricing_v7_final.pkl from a public model hub fine-tune and loaded with torch.load, with no hash check. Nine production models reference training-data snapshots that no longer exist. Three depend on a library version that can no longer be installed. One API key is hardcoded in a training script in Git, and the same key is still active. Separately, the fraud team wants weekly automatic retraining, arguing that manual approval is the bottleneck behind a two-point AUC gap to a competitor.
1. Which three controls do you build first, and how do you justify them to a sceptical head of analytics?
Read the worked answer
First: a registry with immutable artifact storage. You cannot remediate what you cannot enumerate, and today nobody can answer "what is in production and what is it made of". The registry stores the artifact by content hash, the training-data snapshot identifier, the container image digest, the evaluation results and the approving owner. Everything else in this answer depends on it existing.
Second: a promotion gate. No path from a laptop to production. Staging, then shadow scoring against live traffic, then a canary percentage, with a named approver and a one-command rollback. This replaces the Slack message with a recorded decision.
Third: environment and artifact integrity. Models load from a signed artifact inside a pinned container, never from a pickle on a shared VM. torch.load on an untrusted file is arbitrary code execution with the service account's permissions; this is not a theoretical risk for a file pulled from a public hub. Quarantine pricing_v7_final.pkl today, rebuild it from a known pipeline, and prefer safetensors or another non-executable format. Meanwhile rotate the exposed API key and move secrets to a managed store with pre-commit scanning.
Justification to a sceptical sponsor. Not compliance language. Frame it as mean time to answer three questions: which models touch customer data, which one changed last Tuesday, and how fast can we roll back. Today all three answers are weeks. After the registry and gate, they are minutes. The AUC gap argument is separate and does not require abandoning review to close.
2. The fraud team wants weekly automatic retraining. What must be true before you approve it, and what would you approve now instead?
Read the worked answer
Approve continuous training; do not approve continuous deployment. Those are two different privileges and conflating them is how organisations ship a model nobody evaluated.
Preconditions for automatic promotion.
- Data validation gates on schema, null rate, range and category drift for every feature, failing closed. The most common cause of a bad automated model is a silent upstream schema change, not a bad algorithm.
- Automated evaluation gates on a frozen holdout plus a recent-window holdout, with a minimum improvement threshold and segment-level floors. A global AUC that rises while the small-business segment collapses is a regression.
- Label-delay handling. Fraud labels arrive weeks late. Evaluate against a delayed-label holdout and monitor decision distribution in the interim, or the gate is blind to the exact period it needs to judge.
- Shadow scoring and canary, with automatic rollback on decision-rate deviation.
- Adversarial drift assumption. Fraudsters adapt to the deployed model. A model that retrains into the same feature distribution an attacker has already learned provides no protection; include a red-team replay set in the gate.
- An accountable owner for each automated promotion, and an audit trail of what changed and why.
What I would approve this quarter. Weekly automatic retraining with shadow deployment and a dashboard comparing shadow to champion. Promotion stays human until the gates have run for eight consecutive weeks without a false pass. That captures most of the freshness benefit and almost none of the risk.