Change authority is the permission to make a system modification, such as editing a policy, changing a firewall rule, restarting a service, or altering an access setting. It is different from the ability to recommend a change: a tool, analyst, or AI agent may detect a problem and suggest a fix without being allowed to apply it.
In cyber security, this separation is a key control. Defenders use it to keep automation bounded, so a remediation agent can propose a known fix but only execute approved actions within preset limits. That reduces the risk of a wrong change at machine speed and makes rollback easier. Attackers also target change authority, because stolen privileged access can let them disable logging, weaken protections, or push malicious configuration changes directly into production.