anything that is not denied explicitly is considered accepted.
looking at the rules, you can do what ever with the UDF, even add sub udf's as long as the communication with the calling script works and it doesn't crash and the results are correct.