In change process it is for some models very important (eg standard change) to make sure that the model and task plan is executed as defined in the model.
Today an operator can modify the task plan on the change record after the model is chosen. secondly any operator with task edit rights can do that - NOT only the operator with change rights (this is because the tasks are a shared "module" for other entities like change or request).
enhance the model entitiy with a tick box to "lock" the task plan when executing a model in the respective change record.
On the change record check if the model has a lock demand on it.. and if yes deny changes to the task plan on that specific change record (except for eg admin or change manager rights that have "overrule" rights - this overrule is needed to make sure a change can be "unstuck" in the process).