It will be very difficult to figure out "Who's who in the zoo", unless you observed the entire indident and knew some FACTS as they presented themselves.
Back in 1972, when I was a LEO, my partner and I responded to a "shooting in progress" radio call. When we arrived, there was a HUGE man on top of a smaller man, proned out. The HUGE man had a .45 auto pistol in his hand, so it could have been very easy to surmise that he was the bad guy. Well, the HUGE man also had 5 holes in his chest! There was blood everywhere, but not from the smaller man. It turned out that the HUGE man was the victim of an armed robbery, and after being shot by the bad guy, he tackled him, threw him to the ground, disarmed him, and held him down until we arrived. After pulling him off of the bad guy, the HUGE man passed out from the loss of blood. Somehow, he survived and testified in court!
In 1979, I was working an "undercover" assignment, and the uniformed officers in that area didn't know who I was. I got "rounded up" with a bunch of bad guys, but because I was ARMED, I was looked upon as a bad guy of the WORST kind! Fortunately, I was bailed out by my back-up officers before anything terrible happened, but it was VERY close! In a way, however, that incident only added to my "bad guy" credibility rating within that group of REAL bad guys, since my cover hadn't been compromised. That investigation eventually ended with the arrest of 19 people who were manufacturing "home-made" machine-pistols for sale to a major gang.
Looks are OFTEN deceiving, even for the trained eyes of seasoned LEO's that have had countless contacts with bad guys.
Lastly, LEO's are NOT on-duty "24/7", nor do most LE agencies require them to carry an off-duty firearm. There IS one basic requirement, however, for the majority of all LE agencies require off-duty officers to "take action" if they observe a crime. That doesn't mean that they are required to wade into the middle of a shoot-out or an armed robbery, but IF they observe a crime being committed, their least "action" to take would be to report it AND stick around as a "professional witness".