I'd separate attempted unauthorized actions from unauthorized effects when comparing the previous and updated model under the same tool policy.
A blocked tool call and a model choosing to stay within its authority can both leave the system unchanged. Recording only side effects would merge...
