Attrition early warning
"By the time someone resigns I have already lost them. I want to know six weeks earlier, and I do not want a list of names on a dashboard."
The signals were real but the data was among the most sensitive in the company. Any design that produced individual risk scores visible to managers would have been correctly refused.
A privacy-first aggregation layer: team-level risk with minimum cohort sizes, no individual scores exposed, and a retrieval layer over anonymised exit-interview text that surfaces themes rather than people. HR owns access; managers see their team's theme, not a ranking.
The first design did produce individual scores. We removed the capability rather than restrict it — a permission is a decision someone can reverse later.
IBM HR Analytics Attrition + public exit-interview text corpus
The cohort-aggregation design and the theme extraction. Deliberately no scoring service: the point of the rebuild is the constraint.