Change Auditor for Active Directory Protection

I would like to know exactly how CA integrates itself into protecting Active Directory from changes. For example, I protect an OrganizationalUnit. I see nothing in the security settings for the OU regarding my protection. Somehow, CA is like the "man in the middle" which protects my object from changes.

Having read the superficial user guides and manuals, the process is not explained.

I would apprecate it if someone could either explain this to me indetail or point me in the direciton of finding the informaiton.

Thanks,

Waldo1984