It could be either, depending on the way the contract was written. Out-of-band would be something like m-of-n control of a secret 'update' key where any proper

It could be either, depending on the way the contract was written. Out-of-band would be something like m-of-n control of a secret 'update' key where any properly signed update-to-script-X message is accepted. You'd vote by providing your segment of the key, or not. In-band would be something like the DAO but where there was a special "update self" proposal with some set of quorum and rules all enforced in-script. Both have their place. In-band is more transparent, and can have a lot of complexity modeling the intended domain. (Classes of shares with more voting power, auditors with vetoes, etc.) Out-of-band is more likely to work in cases where the script has major bugs.