Here, we might also verify that nothing was created or updated, since the user didn't have authorization to do so:

And I see 1 Content Type Group with identifier "some_string"
And I don't see 1 Content Type Group with identifier "another_string"