CIP-113 programmable tokens: who can trigger third-party actions?
I used the link on BYDFi's ADA page to get to the Cardano developer portal, then found CIP 0113 through the portal's CIPs link. CIP 0113 was still listed as Proposed when I read it. I checked the section on third-party actions to see who it allowed to trigger them.
In the document's auto-compounding example, any user was allowed to trigger the action. It also described actions that required signatures from designated keys. Those choices were defined in each token's own implementation, which the document called a substandard. The third-party script there defined both the available actions and who, if anyone, was authorised to trigger them. So I couldn't infer a token's third-party permissions from the CIP 0113 label alone.