Not being an authority on MVEL's usage in Drools, I can't answer your question. But I'm somewhat surprised about the motives of your "security folks" to question "runtime interpretation". Therefore, I'll digress and highlight a couple of notions. You might discuss them with your boffins. Take Java. It compiles into byte code, which is interpreted by a JVM (and may or may not be hotspot compiled at runtime). So, all of your application is subject to "runtime interpretation". If you look at the Drools implementation of Rete, you'll find that it represents rule conditions as a node network, a representation of logic by data. Thus, any WM updates are (more or less) interpretative. Compared to these two, any other questions w.r.t. runtime interpretation rather secondary, don't you think? -W On 26/03/2012, Mike Melton <mike.melton(a)gmail.com&gt; wrote: