So something like: "An LRS MUST NOT trust the authority in the event the account name is from the same source as the unregistered application"?   

I'd still like to get more granular than this if possible - the LRS MUST NOT overwrite the previous authority, the LRS MUST store such a statement with no authority if there is no current authority, etc.

Or should we not speculate on the operations an LRS would do with an untrusted source?