What about assignment objects within the sub-allocation? Who makes these; the LIR or the user/reseller/downstream provider?

You can add your downstream operator's maintainer in the mnt-lower: of the SUB-ALLOCATED PA object, which will allow them to make these assignments themselves. The LIR is always responsible for all objects within its allocated range, so it is recommended that LIRs have contracts that require downstream network operators to follow the RIPE community’s policies when those operators have sub-allocations. A sub-allocation effectively allows your Assignment Window to be used by your downstream partner in the sub-allocated space. Thus it is important that they know and follow RIPE community policies.