The update is usually done by a person, who shall have the credentials (password protecting the maintainer or the PGP key that shall be used to authenticate).
Objects are protected by a mntner, and they shall contain a reference to the mntner usually in the form of mnt-xxx (examples are mnt-by, mnt-lower, mnt-routes, mnt-domains etc).