we already need to trust the people who write the configuration files that will contain the values used in the eval.

Beware Hanlon's Razor. Are you trusting them to be competent or just benign? In your shoes I would be untainting their input very conservatively.