anomaly detection

Almost no labels means you cannot train a classifier and you cannot honestly report recall. The senior answer is to score by typicality, threshold by the customer's review budget, and build the labeling flywheel that turns this into a supervised problem within two quarters.

A real customer ask from the field, and a layered design question in disguise: attribution, budgets, anomaly detection, and enforcement, plus the attribution problem that decides whether any of it works.