I'm somewhat more comfortable with making ACL changes because they have tests I can write in the ACLs themselves, plus I can specifically target users with new ACLs.

I'm more concerned about making any DNS changes at all. Or adding/modifying subnet routers.