We need a way to manage granular controls
Transfer is so nuclear.
Setting a any text record is no big deal.
Managing control to set, or change, a specific text record could be delegatable.
Revoking a subdomain should also be delegatable.
What else might be manageable like that?
Agreed. And everything an owner can do with their name NFT, can be delegated through a controller contract, and "flash" permissions. Such as how the subdomain registrar currently works for (free) id.wei mints by pulling, minting, and then, returning the id.wei parent NFT after the mint is accomplished. These kinds of atomic permits through NFT allowances are a simple, but flexible enough tool to do most of what we want, without increasing code surface much.
Can see subdomain registrar code (note the flash, not the escrow pattern): https://github.com/src-company/wei-names/blob/main/src/SubdomainRegistrar.sol
The permissions set you mention here are good to nail down - I'll post updated draft code for the community to consider before considering integrating into the WNS dapp.