We're just beginning to implement iLog Rules for .Net at work.  A common debate is whether we should use a rules engine for validating data.  Certainly, one can use a rules engine for validating data but it seems like a misuse of the technology.

In my mind, a business rule is a policy that governs a business action.  The data should already be valid before invoking the business rule/policy.  Of course, the business rule/policy must handle invalid data, ergo the ambiguity between data validation and business policy.

For example, let's say you have a business policy that determines an action based on a range of values.  The total range is between 0 and 100.

0 to 50 approved - 51 to 100 denied. 

What if the data is less than 0 or greater than 100?  Do you place a UI/Data validation rule allowing only 0 to 100? Or, do you throw an exception if no decision is returned from the rule engine?  I believe in this case, you validate that the data is numeric, let the business policy determine the action or throw an exception.  Taking this approach allows you to be flexible to changing business policy; separate rules from the code and places the responsibility on the business to determine the correct action.