Architecting the AI Bridge: Integrating LLMs and DMN With Drools, Sp... Tim Wuthenow & Alex Porcelli
Details architecting the AI Bridge: Integrating LLMs and DMN With Drools, Sp... Tim Wuthenow & Alex Porcelli and evaluates key implications for security practitioners.
Summary
## Overview Tim Wuthenow and Alex Porcelli present a hybrid AI architecture that combines Large Language Models (LLMs) with Symbolic AI to overcome the limitations of each approach. Using a healthcare scenario—a patient with stage 4 cancer on a remote island with no hospital beds available—they illustrate why LLMs alone are insufficient: these models provide statistically correct but situationally inappropriate answers because they lack deterministic, context-aware decision logic tailored to specific business requirements.
## Key Topics The speakers argue that while LLMs excel at processing unstructured data and complex inputs, they are inherently non-deterministic and trained on static data. Conversely, Symbolic AI—specifically through Decision Model and Notation (DMN) and the Drools rule engine—provides deterministic, auditable, and business-friendly decision-making. The solution is a hybrid bridge that leverages both technologies via the MCP (Model Context Protocol).
## Technical Details **DMN (Decision Model and Notation):** An open standard that is graphically visualizable, human-readable, and executable. Decisions are modeled using decision tables (similar to spreadsheets with conditions and outcomes). DMN is non-developer-friendly, allowing business analysts and domain experts to define and modify rules. It is self-documented and LLMs are already trained to explain DMN logic.
**Drools:** An open-source rule engine maintained by the Apache Foundation that processes DMN models. It has been used for approximately 20 years.
**MCP Integration:** A Spring Boot application serves as an MCP server that exposes a catalog of available DMN decisions, along with their input and output schemas. This enables LLMs to discover, query, and execute decisions dynamically through a bidirectional interaction layer.
**Implementation:** A straightforward Spring Boot Maven project with DMN files in the resources folder and Drools as a dependency. The system provides REST endpoints, Java APIs, and native APIs alongside the MCP interface. In the demo, they illustrated querying available policies, understanding input requirements (e.g., "Is patient a cancer patient?", "Hospital beds available?"), executing decisions, and dynamically adding new rules (e.g., stroke-patient routing) without recompiling application code.
## Takeaways - **Hybrid AI is Essential:** Combining statistical (LLM) and deterministic (Symbolic AI) models produces robust, auditable, and contextually appropriate decisions. - **Auditability and Compliance:** DMN's deterministic nature and traceability are critical for regulated industries (healthcare, finance, insurance) where decisions must be replayed and explained to regulators. - **Instant Adaptation:** Changes to DMN rules are immediately available to LLMs through the MCP protocol, enabling real-time policy updates (e.g., Friday evening pricing changes). - **Business Ownership of Rules:** Domain experts can modify business logic without developer intervention, accelerating decision-making cycles. - **Open Standards Matter:** DMN's status as an open standard ensures vendor independence and LLM familiarity.
Related talks
nullcon·25 min
Presenters detail vulnerability discovery and exploitation in The Future Of Augmented Appsec Integrating Llm Reasoning Into Burp Workflows With Vista.
The Linux Foundation·32 min
Seokhwan Kong
Outlines beyond Round-Robin: GPU-Aware Load Balancing for LLM Inference in Kubernetes and evaluates key implications for security practitioners.
The Linux Foundation·43 min
Kevin Hannon
Discusses being a Maintainer in the Age of LLM Mania and evaluates key implications for security practitioners.


