The three questions this function asks are the three basic set operations, wearing different words.

before = {'host': 'a', 'port': 80, 'debug': False}
after  = {'host': 'a', 'port': 443, 'tls': True}

before.keys() - after.keys()      # {'debug'}          -> removed
after.keys() - before.keys()      # {'tls'}            -> added
before.keys() & after.keys()      # {'host', 'port'}   -> candidates

# Of the keys in both, only those whose values differ have changed
[k for k in before.keys() & after.keys() if before[k] != after[k]]   # ['port']

• dict.keys() is already a set

  You do not need set(before) — .keys() returns a view that supports -, & and | directly, without building a copy. Difference is 'in this one and not the other', intersection is 'in both'. Naming the operation rather than writing the loop means the reader sees the intent instead of reconstructing it from a conditional.

• Set operations lose the order, so put it back deliberately

  A set has no order, so iterating one of these results directly gives an arbitrary arrangement that can differ between runs. Iterating the original dictionary and testing membership against the set keeps the author’s order and is just as fast — the membership test is O(1). Use the set to decide, use the dict to order.

• The changed entry holds both values because one is not enough

  Reporting only the new value tells the reader what the state is, not what happened — and 'port is 443' is far less useful in an audit log than 'port went from 80 to 443'. A tuple of (before, after) is the smallest thing that carries the whole change, and it is what makes the output reversible.

def diff_dicts(before, after):
    gone = before.keys() - after.keys()
    new = after.keys() - before.keys()

    return {
        "added": {key: value for key, value in after.items() if key in new},
        "removed": {key: value for key, value in before.items() if key in gone},
        "changed": {
            key: (before[key], after[key])
            for key in before
            if key in after and before[key] != after[key]
        },
    }

• Make it recurse into nested dictionaries, and design the output shape before you write any code — that is the hard half.
• Write apply_diff(before, diff) that reproduces after, then check the round trip on every case here.
• Add an ignore argument for keys that always differ — timestamps, request ids — and notice how much noise it removes from a real config diff.