The factors in depth
Labelled data and labels
Supervised ML needs examples of the outcome. Ask: how many labelled positives exist, how long until more arrive, are labels trustworthy, and were they produced by the current rules (selection bias)? Without labels the options are rules, unsupervised aids (anomaly scores to help analysts write rules), or a labelling programme.
Signal complexity
If the outcome depends on one or two conditions an expert can name, rules are as good as a model and far
cheaper. If it depends on many weak signals and their interactions (fraud from device, velocity, merchant,
geography and time), people cannot write those rules, and ML wins. rule_learner.py measures this directly:
the AUC gap between a depth-2/3 tree and the model.
Change rate
Adversarial domains (fraud, spam, bots) shift weekly; rules lag. Stable policy domains (eligibility, compliance thresholds) do not change unless the policy does, and when it does the rule must change exactly, which ML cannot guarantee.
Rule maintenance pain
Signs the rule base is the bottleneck: hundreds of rules, rule order matters, overlapping and contradictory rules, nobody knows why a rule exists, every change causes surprises.
Scale
At low volume, total cost of ownership dominates: an ML lifecycle (data pipelines, retraining, monitoring, on-call) costs the same whether it makes 100 or 10 million decisions. At high volume small precision gains are large in money.
Error cost
If one wrong decision is catastrophic (safety, legal exposure), keep a deterministic rule as the last line, even with ML upstream.
Explainability and regulation
Credit, insurance, employment and housing decisions often require specific reasons (adverse-action notices). Options: rules, points-based scorecards (logistic regression on binned features), monotone-constrained GBMs with reason codes from SHAP. Exact, legally reviewed rules beat models when the reason must be deterministic.
Latency and infrastructure
A rule in the application costs microseconds and no infrastructure. A model needs feature computation, serving, versioning. If there is no serving path, a model can still be compiled into rules (tree extraction) or a lookup table.
Team maturity
A model nobody can retrain, monitor or debug decays silently. Rules decay too, but visibly.
Annual cost comparison (template)
| Item | Rules | ML |
|---|---|---|
| Initial build | analyst + engineer weeks | data + ML engineer months |
| Infrastructure | none / rule engine licence | feature store, serving, monitoring |
| Maintenance | rule edits per month x hours | retraining, drift investigation, on-call |
| Error cost | FP x cost + FN x cost at rule precision | same at model precision |
| Total |
ML is justified when (error cost rules − error cost ML) > (ML build + run − rules build + run) with margin
for the uncertainty in the error-cost estimate.
Worked decisions
Invoice reminder when payment is overdue
Signal: one condition (days overdue). Labels: plenty, but no learning needed. Verdict: RULES. A model could optimise when to remind (uplift), a different decision.
Card fraud review queue
Signal: many weak interacting features; adversarial drift; millions of transactions. Verdict: HYBRID leaning ML: model ranks the review queue; hard rules for sanctions, blocklists, velocity limits; analysts can add emergency rules during an attack.
Support ticket routing
Signal: text plus metadata; 30 queues; rules are keyword lists that conflict. Labels: resolving queue (noisy). Verdict: ML with a keyword-rule fallback and human correction logging.
Loan eligibility
Policy thresholds (age, residency, minimum income) are law/policy: RULES. Risk ranking among eligible applicants: interpretable model (scorecard or monotone GBM) with reason codes. Overall: HYBRID.
Infrastructure alerting
Known failure modes have clear thresholds: RULES. Unknown anomalies across thousands of metrics: anomaly detection to suggest alerts, analysts promote them into rules: HYBRID.
Product recommendations
Personalisation over thousands of items: ML; rules for business constraints (out-of-stock, age restrictions, contractual placements).
anomaly-detection-model-builder
Build and evaluate anomaly detection for tabular, sensor and transaction data with few or no labels: define the anomaly type (point, contextual, collective), choose detectors (robust z-score/MAD and IQR rules, Mahalanobis with robust covariance, k-NN distance, LOF, Isolation Forest, one-class SVM, PCA reconstruction / autoencoders, forecasting residuals for time series), combine them by rank, explain each alert by its deviating features, set thresholds from an alert budget or the score distribution, and evaluate with precision@k, PR-AUC and recall on known incidents, or detector agreement when no labels exist. Includes pure-Python detectors (robust z, Mahalanobis, kNN, Isolation Forest, ensemble) and an evaluation script.
catboost-model-builder
Build CatBoost models that use its strengths correctly: raw categorical columns as cat_features (ordered target statistics, no manual encoding), text_features, Pool construction with NaN-safe categories, ordered boosting and has_time for temporal data, symmetric (oblivious) trees, overfitting detector with eval_set and use_best_model, losses for classification, regression (Quantile, Poisson, Tweedie) and ranking (YetiRank), class weights, monotone constraints, feature importance (PredictionValuesChange, LossFunctionChange) and SHAP values, GPU training and model export. Plans cat/text/numeric columns from a CSV and generates a runnable training script, and checks parameter sets for the conflicts CatBoost rejects (iterations vs n_estimators, Bayesian bootstrap with subsample, multiple class-weight options, depth > 16, use_best_model without eval_set).
categorical-encoding-selector
Choose and implement the right encoding for every categorical column given the model family and the data: one-hot (with infrequent-level grouping and handle_unknown), ordinal with an explicit order, cross-fitted target encoding (scikit-learn TargetEncoder, CatBoost ordered statistics, category_encoders inside CV), frequency/count encoding, feature hashing, native categorical support in LightGBM, HistGradientBoosting, XGBoost and CatBoost, prefix levels for codes (zip3, NAICS-2), and embeddings. Measures cardinality, rare-level share, unseen-level rate on a time-ordered holdout and target signal per column, emits the ColumnTransformer, and quantifies target-encoding leakage (in-sample vs out-of-fold vs holdout AUC).
classification-model-selector
Choose the right classification algorithm for tabular, text or mixed data and prove the choice with a fair bake-off: logistic regression (L2, L1, elastic net), linear SVM, naive Bayes, k-NN, RBF SVM, decision trees, random forest, extra trees, HistGradientBoosting, LightGBM, XGBoost, CatBoost, explainable boosting machines (EBM/GAM), points scorecards and MLPs, matched to data size, width, categorical and high-cardinality share, missingness, class imbalance, text, and constraints such as interpretability, monotonic constraints, calibrated probabilities, latency budgets and tiny deployable models. Ranks candidates with starting hyperparameters and cautions, then generates a bake-off script running every candidate on identical CV folds with per-fold metrics, fit time and prediction latency.
clustering-algorithm-selector
Choose the right clustering algorithm and check that clustering makes sense at all: cluster tendency (Hopkins statistic with a correlated-features caveat, nearest-neighbour isolation), then k-means / MiniBatchKMeans, Gaussian mixtures with BIC, agglomerative (Ward, average, complete, single) with dendrograms, DBSCAN, HDBSCAN, OPTICS, spectral clustering, BIRCH, mean shift, k-prototypes and k-modes for mixed or categorical data, and Gower distance, matched to data size, expected shapes, noise, varying density, known k, soft memberships, hierarchy and streaming. Covers preprocessing (scaling, encoding, dimensionality, distance metrics), validation (internal indices, bootstrap stability, external labels, business profiling) and assigning new points.
collaborative-filtering-implementer
Implement collaborative filtering recommenders that beat popularity: item-based kNN with cosine, Jaccard or asymmetric similarity, shrinkage, neighbourhood size, positive-only or mean-centred rating signals and 'because you liked X' explanations; implicit ALS with confidence weighting, BPR pairwise ranking and the closed-form EASE model in plain NumPy, tuned on a temporal validation split by recall@k and NDCG@k and refit on all data; plus user-kNN, explicit matrix factorisation, the implicit/LightFM libraries, hyperparameter ranges, cold-start fallbacks, scaling with sparse matrices and approximate nearest neighbours. Produces top-k lists in the format of the recommendation evaluator.