So if you enable the 'auto whitelist first party domain' rule you can't go to a website, unwhitelist the domain, lock it, and then have it persist. If you reload that domain will be whitelisted again.

I think the expected behavior of the user is that the domain would be whitelisted upon first visit, but not be some permanent setting.