Summary

A developer asks:

Is there any way to create a rule that is final, but only for certain users?  We're setting up an Application Service Provider (ASP) model, and we want to have a group of users who can execute a rule but NOT modify it or override it. 

That sounds like a final rule.  However there is another, small group of users who will need to modify these rules.

Suggested Approach

Within a RuleSet, a rule can have multiple versions even if it is final.  Therefore your unrestricted users can have a development version number of a final rule, allowing them to update that version of the rule. 

However, the restricted users would not be provided the development version number of the RuleSet, therefore allowing them to execute final rules but be bound by their RuleSet version constraints.

Final availability does not mean "unmodifiable", if the rule belongs to a RuleSet version that is not locked. Final only means "cannot be overridden".