For commands like bulkupdate, it would be nice to have a dry run argument that would show you what happens before you actually execute so you do not accidentally mess up your permissions.

Will be included as part of larger changes to the bulk update system, to be implemented after #1739