Cal Poly Enterprise Risk Management Platform

Deployment

Cal Poly built this platform through the AWS DxHub partner program. It is a team project, not solo work, and I want that on the record. My part was the AI layer: a RAG mitigation engine on Amazon Bedrock, hybrid search over pgvector, and deterministic scoring that turns qualitative risk inputs into ranked numbers. It piloted with EHS and Risk Management in March 2026, was presented to CSU systemwide EHS Directors in June 2026, and is now live for the team behind a login. The records inside are real departmental risks, so every screenshot here uses synthetic data with a visible label. All of the Cal Poly tools are set to extend to the Solano campus next, and to Maritime after that.

Problem

Cal Poly ran its enterprise risk process on a 34-sheet Excel workbook. Formulas broke, cells threw #N/A errors, and nobody could work on it at the same time. There was no audit trail, so accountability depended on memory and email threads instead of a system of record.

Build

The current platform runs on Next.js 16 with React 19 and TypeScript on the frontend, AWS Cognito for auth with group-based admin roles, and AWS Lambda behind API Gateway on the backend. Staff submit departmental risks, the backend scores them and drafts mitigation suggestions, and admins review results on a heat map and analytics dashboard. My own contribution traces back further, to an earlier phase of the work. I architected the context-aware RAG pipeline on Lambda and Bedrock that grounds those mitigation suggestions, and built a mitigation engine that keeps outputs ISO 31000 compliant instead of generic model text. I shipped hybrid vector search on RDS with pgvector, so the system filters by metadata and searches by meaning in the same query. I also engineered the deterministic scoring logic that turns qualitative model output into a ranked, quantitative risk score. Before any of this had a real backend, I built three single-file HTML prototypes to prove the risk-matrix concept cheaply. Those prototypes became the business case that brought DxHub in.

The repository is the team’s and it is public; the walkthrough above covers only the parts I built.

Proof

• 
• 
• 
• 
• 

Synthetic data

The backend risk-scoring pipeline is deployed and live on API Gateway. It connects workers’ compensation loss history with a departmental risk register; the portfolio shows only synthetic examples. The team presented the platform to CSU systemwide EHS Directors. On the repository itself I hold 5 of 31 commits. This was built with a team, and the screenshots here show synthetic data only, never a real department or a real claim.

What I would do next

I would finish the UI refactor and open the platform to departments beyond the first two. I would also add drift monitoring on the scoring model now that it runs against a growing claims history, so the thresholds stay honest as more departments start submitting risk.