Police say university should have gained permission from "highest" security authorities, after one died in mock attack.