There is a lot of talk with Web Services about "Metadata", which after all is just "data about data". The problem is that people sometimes seem to think that "metadata" means that it isn't actually code and shouldn't be treated as such. So Business Rules, and even BPEL sometimes, are described as metadata which can magically be handled differently. Several companies enable Business Rules to be changed on the running system via a web browser, and talk about end-users doing this on the production system.
Of course when you actually talk to the vendors and use phrases like "please god tell me you are kidding" they admit that while you CAN change rules at runtime its not often a very smart idea. Mostly they then talk about changing parameters to rules (so fraud check is above $2000 becomes above $1000) rather than adding in complex new rules at runtime.
The problem is that these elements are being pushed in the same way as "configuration" was pushed on packages a few years ago. The belief is that just because it isn't old style "development" it is some how easier and requires less rigour. The reverse is actually true, because these elements are so central to the operation of the system and contain core logic they require MORE testing and MORE formalism than the rest of the application.
Java is metadata, it describes in an abstract sense a set of operations on the JVM, the JVM itself has instructures which are metadata, describing as they do some abstract concepts that are mapped down onto the processor. And using the latest Java VMs you could change the class at runtime and hotswap it... you could even build a web browser interface to let anyone do it.... this wouldn't be smart, so why is it smart when its rules or process?
Just because something is described in an XML document, or an Excel sheet, doesn't mean it might not actually be code. And if it is doing business logic, whether than be process, decisions or whatever then it should be treated in the same way.
Calling Business Rules, Process or transformations (like XSLT) "metadata" and pretending they won't go boom is a sure fire way to create one hell of a mess.
The measure I use is simple : If its got an "if" statement in it... its code.
And it reminds me of a comment made to me a few years ago about a package vendors implementation "they said it was just configuration, but 50 people configuring a product for 2 years sure looks like development to me"