You're right that the rule as stated is incorrect (and I internally corrected it to "it can either create a permanent symbol that won't be collected or give acc

You're right that the rule as stated is incorrect (and I internally corrected it to "it can either create a permanent symbol that won't be collected or give access to internal symbols", so for a moment I didn't know what you were responding to). I think the spirit of the rule is still good, which is raising these sorts of questions at design time and code review: Do you need INTERN? If so, are you INTERNing into the right package? If you are using a temporary package, are you remembering to DELETE-PACKAGE? Do you really need INTERN in an Internet-exposed interface? Does your use of INTERN prevent exposure of sensitive symbol plists to attackers? Does your code rely on private symbols to keep keyword arguments from being used in the public interface, and will INTERN accidentally circumvent it? Is the lifecycle of the temporary package sufficient to prevent DoS? etc.