At some point you would need to see the results of the rules applied, thus, you'd need IO.
It's a good idea, and Facebook actually does something like this for their spam filtering rules: https://engineering.fb.com/2015/06/26/security/fighting-spam...