Permissions to upload and deploy change sets
Key Takeaway
Deploying an inbound change set takes two permissions in the receiving org: "Deploy Change Sets" and "Modify Metadata Through Metadata API Functions". One alone is not enough.
Change sets move customizations, stored as metadata, from one Salesforce org to a connected org, such as from a sandbox to production. Moving changes takes two separate actions in two orgs. First, a user uploads the change set from the source org. Then a user deploys it in the receiving org. Each action needs its own user permissions, so a user who can upload a change set can't automatically deploy one.
Outbound and inbound change sets
A change set has a different name in each org. In the org where you build it, it is an outbound change set that you send to another org. In the org that receives it, it is an inbound change set.
A common flow is to build and test customizations in a sandbox, then send them to production. In that flow, the change set is outbound in the sandbox and inbound in production.
Uploading and deploying are separate steps. Sending an outbound change set doesn't guarantee the changes take effect, because the changes apply only after the receiving org deploys the change set.