The right for existing member states to adopt transition measures was enshrined in the treaty of accession itself. It was then up to each member state to enacts restrictions (or not) and notify them to the Commission. The treaty limited the type and length of restrictions that could be imposed and also gave the new member states the right to retaliate with similar restrictions but member states did not need explicit permission to put them in place.
EU institutions like the Commission and Parliament had a very limited role in this process. The Commission did have a hand in it inasmuch as it is the in charge of managing EU enlargement negotiations but treaties are adopted and ratified by the member states directly. In EU parlance, treaties are called “primary law”, whereas the directives and regulations adopted through the EU legislative process, Commission decisions, etc. are considered “secondary law” (derived from the treaties).