If adding security rules is going to be computationally intensive, might I suggest at least:
1. Doing it in a separate thread from the one that makes the UI responsive, and
2. Giving that thread a lowered priority?
Basically, the same as is already the case for hashing.