A system, method, and program product is provided that distributes authorized changes to the organization's entities and has the individual computer systems police configuration changes. A system receives change approval packages, each of the change approval packages including authorized change identification data that identifies authorized changes to the system. The authorized change identification data are stored in a storage area of the system. Subsequently, a change package is received by the computer system. The change package includes a change to the computer system and metadata that identifies the change. The metadata is compared with the authorized change identification data. If the metadata matches one of the authorized change identification data, then the change is installed, otherwise the change is rejected.