Yes. The same ERC-20 standard.
The ERC-20 standard dictates which functions (and events) must be present in your contract and with what signatures. If your contract has the required functionalities it is considered ERC-20 compliant.
The standard does not tell you:
1) How you should implement the functionalities or
2) What extra functionality you can have in the contract
So in theory you could even skip the real implementation part and have empty functions (except return dummy values where needed by the function signature). You don't even have to ever emit the events. And the contract would still be ERC-20 compliant.
So you can add whatever functionality you want to your ERC-20 contract. You can add it inside the standard functions or you can add extra functions. You can also write it as insecure & dubious as you want.
The only problems you will face with some "special" implementation is that exchanges won't probably accept the token as it has security issues and/or users may not want to buy it.