System properties apply to the JVM. When the JVM executes multiple apps may be executing in it. Any app in the JVM can change a system property that is not restricted. In general, I don't recommend setting system properties unless it is for a property value that is for all the apps in the JVM.
However, to answer the question, access to the System object is controller by the SecurityManager. When you start the JVM, a security manager can be loaded. This security manager will be notified of any attempt to change a system property. However, if you are on a
j2ee web server, you may not be able to load your own security manager as most J2ee environments supply a security manager that you cant override. These seucrity managers usually have a way to restrict system property changes. You can restrict the changes and see who get a the SecurityException.