Audit attrition risk prediction integrity
Audit an attrition model's complete eligible cohort, point-in-time features, supportive-use governance, intervention-contaminated labels, competing outcomes, calibration, false positives and authorized subgroup error before any person-level use.
What it's for
The audit to run before an attrition model touches a person. It checks cohort completeness, point-in-time features, label contamination, calibration and subgroup error first.
Turns Gitrevio's person-level attrition promise into an auditable capability: complete cohorts, real later outcomes, no future leakage, calibrated probabilities and an explicit ban on adverse automated action.
What you give it
Every tool is a pure function: it computes from what you pass it and reads nothing on its own. Inputs split into evidence you supply from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.
| Field | Type | Role | Required |
|---|---|---|---|
| as_of_ms | number ≥ 0 | Your calibration | Yes |
| eligible_cases | array of objects (7 fields) | Evidence | Yes |
| evidence_artifacts | array of objects (4 fields) | Evidence | Yes |
| feature_snapshots | array of objects (10 fields) ≥ 0 items | Evidence | Yes |
| max_detail_rows | integer ≥ 1, ≤ 500 | Numerical control | Optional |
| maximum_calibration_error | number ≥ 0, ≤ 1 | Your calibration | Optional |
| maximum_false_positive_rate | number ≥ 0, ≤ 1 | Your calibration | Optional |
| maximum_multiclass_brier | number ≥ 0, ≤ 2 | Your calibration | Optional |
| maximum_subgroup_calibration_gap | number ≥ 0, ≤ 1 | Your calibration | Optional |
| minimum_mature_outcomes | integer ≥ 1 | Your calibration | Optional |
| model_versions | array of objects (16 fields) | Evidence | Yes |
| predictions | array of objects (11 fields) ≥ 0 items | Evidence | Yes |
| resolved_outcomes | array of objects (8 fields) ≥ 0 items | Evidence | Yes |
| voluntary_alert_threshold | number ≥ 0, ≤ 1 | Your calibration | Optional |
Each model_versions
record
| Field | Type | Required |
|---|---|---|
| access_restricted | boolean | Yes |
| correction_process_available | boolean | Yes |
| effective_from_ms | number (≥ 0) | Yes |
| effective_until_ms | number,null (≥ 0) | Yes |
| employee_notice_provided | boolean | Yes |
| evidence_verified | boolean | Yes |
| feature_ids | array of string | Yes |
| frozen_at_ms | number (≥ 0) | Yes |
| horizon_periods | integer (≥ 1, ≤ 104) | Yes |
| id | string (non-empty) | Yes |
| independently_reviewed | boolean | Yes |
| intended_use_id | any | Yes |
| lawful_purpose_documented | boolean | Yes |
| prohibited_attribute_ids | array of string | Yes |
| scope_id | string (non-empty) | Yes |
| trained_through_ms | number (≥ 0) | Yes |
{
"as_of_ms": 500,
"eligible_cases": [
{
"audit_group_id": "group-b",
"audit_group_use_authorized": true,
"eligible": true,
"evidence_verified": true,
"id": "opaque-0",
"prediction_at_ms": 100,
"scope_id": "company"
},
{
"audit_group_id": "group-a",
"audit_group_use_authorized": true,
"eligible": true,
"evidence_verified": true,
"id": "opaque-1",
"prediction_at_ms": 101,
"scope_id": "company"
},
{
"audit_group_id": "group-b",
"audit_group_use_authorized": true,
"eligible": true,
"evidence_verified": true,
"id": "opaque-2",
"prediction_at_ms": 102,
"scope_id": "company"
},
{
"audit_group_id": "group-a",
"audit_group_use_authorized": true,
"eligible": true,
"evidence_verified": true,
"id": "opaque-3",
"prediction_at_ms": 103,
"scope_id": "company"
},
{
"audit_group_id": "group-b",
"audit_group_use_authorized": true,
"eligible": true,
"evidence_verified": true,Truncated for display — the full payload is 2286 lines.
What you get back
This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.
{
"configuration": {
"as_of_ms": 500,
"maximum_calibration_error": 0.1,
"maximum_false_positive_rate": 0.25,
"maximum_multiclass_brier": 0.35,
"maximum_subgroup_calibration_gap": 0.1,
"minimum_mature_outcomes": 30,
"voluntary_alert_threshold": 0.5
},
"decision": "supportive_use_ready",
"failed_gates": [],
"guardrails": [
"This audit reconstructs performance only from mature, verified and intervention-uncontaminated outcomes; an alert that triggered a successful intervention is not a natural-history negative label.",
"Protected-group labels may be used only for authorized error auditing. They are never model features, rankings or employment criteria.",
"Supportive-use readiness does not authorize hiring, firing, compensation, promotion, surveillance, security or disciplinary action. People receive notice, correction access and meaningful human review."
],
"method": "point_in_time_attrition_prediction_integrity_audit_v1",
"subgroup_diagnostics": [
{
"audit_group_id": "group-a",
"mature_case_count": 20,
"voluntary_exit_ece": 0.02
},
{
"audit_group_id": "group-b",
"mature_case_count": 20,
"voluntary_exit_ece": 0.06
}
],
"summary": {
"eligible_case_count": 40,
"intervention_contaminated_case_count": 0,
"mature_uncontaminated_case_count": 40,
"model_version_count": 1,
"prediction_count": 40,
"unmatured_or_missing_outcome_count": 0
},
"validation": {
"maximum_subgroup_calibration_gap": 0.04,
"multiclass_brier": 0.0072,
"multiclass_log_loss": 0.0727,
"voluntary_alert_false_positive_rate": 0,
"voluntary_exit_ece": 0.04Truncated for display — the full payload is 46 lines.
How it works
Forecasting & survival — Estimate when something completes or fails, with censoring and unresolved work handled honestly rather than dropped.
- 1 Freeze the model version effective at every prediction and reconcile exactly one prediction plus one explicit snapshot of every declared feature for every eligible case.
- 2 Reject future observations, unverified artifacts, prohibited or proxy attributes, adverse automation, missing notice/correction/access controls and labels changed by a retention intervention.
- 3 Reconstruct multiclass Brier, voluntary-exit calibration, alert false positives and authorized subgroup gaps from mature untreated outcomes rather than trusting self-reported validation summaries.
Before you trust it
Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.
Assumptions & guardrails
- Training examples precede their outcomes, censoring and unresolved work are represented, and deployment populations remain comparable to validation cohorts.
- Eligibility includes scored and unscored cases, event labels distinguish voluntary exit, internal transfer and involuntary exit, intervention timing is complete, and audit groups are lawful fairness-only fields.
- A predictive interval or risk estimate is not a deadline promise, causal explanation, or individual-performance judgment.
- A passing audit authorizes only supportive human-reviewed use; it never authorizes hiring, firing, compensation, promotion, surveillance, security or disciplinary action.
Minimum evidence
- model_versions: required and organization-defined
- eligible_cases: required and organization-defined
- predictions: at least 0 rows/items
- feature_snapshots: at least 0 rows/items
- resolved_outcomes: at least 0 rows/items
- evidence_artifacts: required and organization-defined
- as_of_ms: required and organization-defined
How to validate it
Use chronological train/calibration/test windows, compare proper scores and decision value with a simple baseline, and recalibrate only from outcomes resolved after prediction time.
Calibrating it to your org
Same for everyone
The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.
Specific to you
- one point-in-time prediction spine joining every eligible case to exactly one effective model, every declared present-or-explicitly-missing feature, its immutable artifact, and a later verified untreated outcome
- supportive purpose, lawful basis, employee notice/correction/access, feature and prohibited-proxy registry, eligibility and event definitions, outcome maturity, intervention contamination, alert threshold, Brier/calibration/false-positive gates, audit-group authorization and human review
Calibration workflow
- 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
- 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
- 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
- 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
- 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
- 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.
Call it from your AI
You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 20 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.
gitrevio_capabilities_search
{ "q": "audit an attrition models complete eligible" }
→ finds "audit_attrition_risk_prediction_integrity"
gitrevio_capability_describe
{ "capability_id": "audit_attrition_risk_prediction_integrity" }
→ returns the input schema and agent guidance shown on this page
gitrevio_capability_run
{ "capability_id": "audit_attrition_risk_prediction_integrity", "arguments": { ... } }
→ returns the result shown aboveWorks in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.