well the particular rub here is that at-uris are in scope for the ietf working group on at protocol. but permissioned data isn't in scope.
so this awkwardly straddles the line if we're trying to tack something onto the uri format while the working group is actively trying to standardize it
in case it got buried, I like Emelia's suggestion:
at://<did>/<extension>/<nsid>
where here <extension> is "space" or w/e to denote private data, avoids new uri or adding some kind of private type to the Lexicon type system