Use Auto-Fix only after stable rules
Keep Dry-Run on until your rules are solid — then Auto-Fix keeps everything in sync.
While you're still iterating on your role rules, leave Dry-Run on (the default for new networks) — then the bot changes nothing, whether or not Auto-Fix (Auto-correct mismatches in Project settings) is on.
Check a rule in Role Rules › Test first — it simulates your rules without writing anything. Then watch the log channel: in dry-run, it shows each change the bot would make, marked as a dry run. A wrong rule shows up there before it changes anything for real.
Auto-Fix is on by default; the moment you turn Dry-Run off, the bot keeps everything in sync and self-heals drift caused by manual edits.