Conclusion

The separation of concerns was successfully implemented.

Users can write the rules. They can update the documentation without interfering with validation or product design.

Developers can implement the validation rules. They do not have to rely on the domain user (unless there is a new rule that is a breaking change). Although the main implementation is in Schematron, other schema languages can be used as well, as long as a reported error links back to the documented rule.

Product designers can rely on the fact that, on the one hand, the same API is triggered to submit the file and filter criteria and, on the other hand, to always get back an XML document in the same format.