oh yeah another tricky one, so, the identifier, is it a pubkey, and someone has the secret, or does its authorised representatives solely make event references that designate an npub to be representative (or remove them), and then you have at least 3 levels - the owner, who first registers the name, do they have extra privileges to add and remove designated npubs? or even cancel the registration, and if not, then you need some scheme of administrators for the name versus simple representatives

it can all be done but it essentially amounts to an access control list

it could be interesting to actually formalise the concept of access control lists altogether, as tehy can have private-to-relay meaning as well as representatives and even company hierarchy trees 

 also note that this is exactly the same engineering problem as DNS