As for how they behave... you have to decide a dozen other factors first. How developed are the systems outside the main world? How much traffic is there in the outer systems? Do ships appear willy nilly all over the place or do you think they actually take steps to provide some safety from the threat of Vargr corsairs from across the border by maintaining some kind of protected space? There's no "facts" about any of this in print, so do whatever you want.
3 Ships is easy as there are 3 major roles. One ship is in Imperial Space patrolling, One ship is in the 100-10D zone assisting the colonials in their policing and the last ship is portside conducting diplomatic duties, shore leave, maintenance etc. and standing by in case of an incident. Imperial Space based incidents will result in the colonial liaison heading out to assist and the diplomatic one taking over colonial duties, if it is in the 100-10D zone the diplomatic one will assist the colonial liaison. Let's say roles rotate every month to keep everyone sharp (and align with the traditional monthly reset in trade).
Any additional ships will be added to the Imperial Space patrol.
Their major role of the ship in Imperial Space will be tagging emergence and jump events to track what jump signatures are in system. These will be tagged with the tonnage of the ship as a start in identification and checks made against any scheduled vessel (since ships file an onward flight plan it is possible the x-boat network will get you this weeks expected arrivals so you can check them off). Where possible these will be correlated with thermal images to produce a database of signatures with track numbers which should already allow a degree of verification of repeat visitors such as scheduled vessels. Whilst a ships thermal signature can change over time it tends to change slowly (or have predictable spike events - thrusters firing for example). At least it will allow you to see that the hot blob that was at the emergence point x is now at bearing b and a likely range since you know it's probable tonnage. The wide variety of jump points assists in this as the closer things are to others the harder corelation of emission information is. You could also probably begin to tell if it is behaving normally and observing over time will tend to confirm its range and thrust capability further categorising it. Better operators and closer tracks might even be able to make a tentative identification of ship type (if it is not a custom vessel that has never been categorised before).
Once that track reaches the 100D point it's transponder can be verified and a dispersion of Colonial ships (and ships boats) should allow it to be monitored on its journey to the planet (and note any deviation from that). This data will be added to the track plot by the IN Liaison and the picture refined. At this point ships that have visited before will already be fully populated, but new visitors may receive a close pass by the colonial navy to visually confirm the transponder data is at least consistent. Ships that are within range will be pinged. If it has no transponder (or the transponder report looks suspect) it will be checked out visually and probably boarded.
When the ship gets to the 10D limit the ground stations will fully interrogate the transponder and there will be additional tracking to collate sample data of emissions and unusual characteristics that will help identify the vessel in other ways (thrust used, manoeuvrability, transmissions will be stored for future analysis etc.).
Ships not already fully categorised will have additional physical checks conducted at the port and any missing registration details filled out.
Any ship behaving in an unusual manner (i.e. not heading directly to the main port, or other legitimate destination) will trigger additional interest, and be prioritised for scanning, if it happens to be close it might also get a fly-by. Where such behaviour begins to move it into closer proximity to another vessel it will become a ship of interest and the sensor operator will ensure a regular update of it's positional information even if this requires de-prioritising routine traffic and the docked ship brought to readiness.
Weapon discharges are more detectable still and will prompt a hostile flag on the vessel. Similarly a May-Day. This will result in the scrambling of the docked ship (and redeployment of the 100-10D ship as necessary). Once the docked ship gets on-station it will take over the duties previously being conducted. The nearest appropriate ship will plot an intercept (be it Colonial or IN). In the event of a non-combat May-Day from an isolated vessel specialist SAR vessels may be deployed to investigate and assist instead.
In the event of a 100-10D event additional fast short range fighters may be deployed.
The expectation is not necessarily that you can prevent a pirate attack, but that having identified one as being in progress you can try to intercept and defeat (even after the fact) or that you can at least categorise the ship involved. Having the sensor operator focus in on the suspect ship means better data being available (they can make more sensor rolls).
Offenders characteristics will be circulated round the sector and the signature put on a watch list. Vessels with a similar signature be subject to closer scrutiny (or harassment depending on your viewpoint). It will definitely be pinged in the 100-10D zone, it will definitely have a fly-by to gather as much information as possible and if it matches a known pirate it will be stopped and boarded and if it resists it will be disabled or destroyed. On landing the captain can expect detailed customs assessment, log analysis and his transponder examined for modification.
Any sensor data will be transmitted as it is received via narrow beam transmitter to the ground stations (thank you Voyager) and relayed to the docked IN vessel for collation. These are periodically uploaded to the x-boats for dissemination round the sector and via encrypted broadcast to the authority vessels to maintain a holistic picture. This data will also be added to the sector fleet database which will form the basis of the individual ships databases.
Computers will also dynamically correlate the combined situational awareness picture to identify anomalies such as a ship leaving port with transponder details that are different to when it was scanned on arrival (or does not match any that arrived at all) for flagging up to sophont analysts for prioritisation and further investigation.
The emergence of a large unexpected ship or a number of large ships arriving in close proximity is probably cause for alarm and might result in the ship in imperial space jumping back to fleet to report it. The remaining vessels will scramble and collate information jumping as any threat develops. An invasion by large capital ships overrides any other duty.
