Approvals
A token account can grant someone else permission to move its balance without asking you again. Marketplaces take one when you list an NFT; dApps ask for one whenever you click approve. They do not expire. This finds them and clears them.
Connect a wallet to see every token account that has granted someone else permission to move its balance. Reading the list signs nothing.