Machine Learning For Risk-Prioritized Infrastructure Policy Enforcement: Reducing False Positives And Enforcement Overhead In Regulated Cloud Environments

Abstract

Cloud policy enforcement in regulated environments produces alert volumes that outpace the human capacity to triage them. Policy-as-Code tools (Open Policy Agent, HashiCorp Sentinel, Kyverno), Cloud Security Posture Management (CSPM) platforms, and Kubernetes admission controllers together generate tens of thousands of policy events per day at enterprise scale, and a substantial fraction are false positives, low-severity findings, or issues already accepted as compensating-control exceptions. The operational consequence is alert fatigue: analysts become desensitised to signals, real high-severity events are missed, and mean time to resolution grows even as the underlying detection stack grows. This paper proposes a risk-prioritisation layer that sits between policy engines and the SecOps triage queue. The layer uses machine learning to (i) suppress or downgrade signals that historical dispositions have shown to be benign, (ii) predict which configurations are likely to drift into non-compliance before they do, and (iii) tune policy thresholds and exception rules from analyst feedback. The paper contributes a three-way task taxonomy for ML-augmented policy enforcement, a four-layer reference architecture that binds signal ingestion, feature engineering, ML scoring, and human-in-the-loop review under an immutable audit trail, a model-selection guide that matches data type (audit log, tabular alert, config drift, multi-signal fusion, feedback stream) to recommended technique, and an evaluation framework that reports both model performance (precision, recall, F1, AUC) and operational outcomes (false-positive reduction, alert volume, mean time to review, missed critical alerts). The paper argues that risk prioritisation is the near-term ML contribution to regulated cloud policy enforcement that clears both the SecOps and the auditor bar, provided the system produces reason codes on every ranking and preserves a compliance-defensible decision-audit store.