Not "expect" directly.. Ideally I would want to have a) clear knowledge of the behavior, b) be able to inform myself about its effect (e.g. see log or alerts), and c) change a setting that allows me to override the rule in manual-approval mode.
Question is what should be default behavior. Say I launch a server exclusively for journalists, set a rule to block yahoo.com ('not trusted') and no manual approval. The time I find a 100 blocked journalists, is when I already lost them.