I struggled to get the Unauthorized Change Detection feature to work, so I contacted my internal colleagues.
@Bill Iffland was able to identify the missing piece, which is a dependency on service mapping.
So, it appears that a dynamic CI group is simply not enough for this feature to work. We had to create a manual service map.
It is unclear to me why this dependence exists, but it does...
I've posted a short video that will hopefully help anyone who is thinking of implementing this feature.
https://www.youtube.com/watch?v=Hg6HScjHLR8&list=PL5DgOfLBA3RanN94xRB4tZGY6aoKeFM_b&index=3
