gotcha. so there are two options readily available: (1) enforce on your side that the user(s) set as owner are part of the namespace or (b) have

permission is_org_member = owner & namespace->is_ns_member

which will only contain users that are both

owner

and a member of the namespace.