Sandro, here's the behaviour I've observed, as I've specifically been bounty hunting at Nav Beacons, and last night I had an awesome couple of hours at a resource extraction site in AO SHUN. Here's my Extraction Site experience from last night...
I SC in to the extraction site. I'm 20-odd km away so fly in and eventually start spotting ships on my scanner, which I then target and look at the basic scan result. If they're clean I leave alone. If they're wanted, I then use my KWS to see if the bounty is worth my time going after.
So. I find a wanted target, and pop them. All is well and a bounty is assigned to me. Great.
I do this again. And a few more times. I'm still clean myself.
Then I notice that a few ships on my scanner have now turned red - but they aren't actively attacking me, and they're clean according to the basic scan result, so I ignore them.
I continue searching for new target ships with bounties, find them, and do battle. I start noticing that the number of spawned NPC's has increased dramatically in the area - this is kind of awesome as it's a great adrenaline rush and I get to have more targets to choose from
I'm still managing not to accidentally shoot security vessels or other clean ships. But there comes a point where a system auth vessel is now shooting at me even though I'm clean. I even had on one occasion last night a system authority Anaconda deliberately fly into me whilst shooting at me, leaving me with 8% hull and barely managing to limp back to a station for repairs. That last one was actually a particularly great adrenaline rush to be honest - BUT, I'd rather that have been caused for a legitimate reason - like being bested by an opponent - rather than an odd reason of being attacked by a system auth vessel without having a Wanted status.
I also had a moment where despite not having Wanted status, a clean but 'red' ship started attacking me out of the blue. (Wondering if I was starting to 'annoy' a faction at that point or what?)
I hope that description helps.