Data administration may be managed by receiving in a computer system a first input identifying a data object to be assigned to a control object in the computer system. A second input for the control object is received in the computer system. The second input specifies a relationship between 1) model-level changes to the data object, and 2) instance-level changes to the data object. After the first and second inputs are received, the control object is sent to another computer system. The control object may be accessed to determine whether a system is authorized to make an object change. This access can be by the system about to make the change, or by a system that receives the object change from another system.