1. Regulation of the sacred liturgy depends solely on the authority of the Church, that is, on the Apostolic See and, as laws may determine, on the bishop.
2. In virtue of power conceded by the law, the regulation of the liturgy within certain defined limits belongs also to various kinds of competent territorial bodies of bishops legitimately established.
3. Therefore no other person, even if he be a priest, may add, remove, or change anything in the liturgy on his own authority.
The third norm is often quoted, but the full context is seen here. The Vatican regulates the Roman Rite, but bishops have a role to do this also, within canon and liturgical law. Bishops’ conferences are the third and final source of liturgical regulation. Obviously not priests or lay people.
I’ve seen norm 3 abused as a beating stick. There are legitimate options given in the Roman Rite, and priests and lay people can often make use of them. Such options are indeed “part” of the liturgy. That said, some crazy things have gone on and continue to be imposed on lay people with regard to liturgy.