Hi Rome,
There are two cases.
1st when there are more than one instance of an authorization object.
For eg, you have added a new T-Code and that tocde has an object binded which was already present in the autorization profile of that role. Now, the object that is coming from this new code will be marked as 'NEW' and the one which was already in the profile will be marked as 'OLD'.
Now, if the default values which comes from Tcode - check SU24. When this is changed it is marked as Changed.
Regards,
Divyanshu