Thinking about your error handling (validate incoming json, validate rules), isn’t the equivalent “Assertions” (https://en.wikipedia.org/wiki/Assertion_(software_development)) in the way that they should be left out/inactivated in the production version of the system?
Would that be something to strive for? Maybe you’re already doing that?
Would you make the distiction between handling of “system errors” (validate incoming json, validate rules) and “user input errors”?
If so, how are you doing that now?