guardian's e-commerce search had no systematic way to know when a search term was failing across a 965k dataset. manual review wasn't scalable — there was no visibility into bad queries, malformed inputs, or injection attempts at that volume.

a layered classification pipeline — rule engine first to handle obvious cases cheaply, ai fallback via gpt-4.1-mini for anything ambiguous. outputs to excel with cause label and confidence score per term, making the results immediately actionable.

rule logic handles obvious cases to cut api cost. gpt-4.1-mini is only called when the engine can't classify confidently — this kept costs predictable and the pipeline fast. fuse.js handles fuzzy matching for near-miss terms before escalating to ai.

manual review cut to near zero. 203 sql injection attempts surfaced as a byproduct of building the classifier — a result that wasn't the original brief but became a key deliverable. the pipeline now runs end-to-end without human intervention.