Users do not need approval to create a ticket.
Depending on how you have osTicket configured you might need to log into the User panel to create a ticket, or your Company might prefer you email the ticket.
Any Agent can create a ticket by logging into the Agent panel.
I'm not sure what you mean by change a ticket. Agents can be granted permission to edit tickets if you want them to be able to do such. There is no authorization for this other than you (as the admin) gave them permission to edit tickets.
