Use Auto-Fix only after stable mappings
Keep Dry-Run on until your rules are solid — then Auto-Fix keeps everything in sync.
While you're still iterating on your role rules, leave Dry-Run on (the default) — then the bot changes nothing, whether or not Auto-Fix is on.
Auto-Fix is on by default; the moment you turn Dry-Run off, the bot keeps everything in sync and self-heals drift caused by manual edits. A wrong rule shows up in the Dry-Run log before it changes anything for real.