How can the Control-M/Enterprise Manager be configured to permit a user to order/force a job or table/folder but not update the job definitions?
How to allow users with only browse permissions to order jobs?

The following video demonstrates the solution provided by this article:

Steps:

1) From the CCM (Control-M Configuration Manager) select Tools -> System Configuration -> Control-M/EM System Parameters -> Advanced, change the parameter "Action_OrderForce_AuthLevel" from UPDATE_ACCESS to BROWSE_ACCESS and save.

2) Stop and Restart the GUI Server via the CCM.

Users can now update tables/folders as long as they are permitted with BROWSE level access and they have appropriate access to the owner / run as user.

Starting with Control-M/Enterprise Manager 9.0.19 ,select the "Allow ordering" property in the Folder tab withing Authorizations:

Documentation example from version 9.0.20
https://documents.bmc.com/supportu/9.0.20/help/Main_help/en-US/index.htm#AuthorizationsTableProperties.htm