The person that created the NPC would generally control them (not all the time of course, just for a brief period of time), unless someone wanted to reuse them (also for a brief period of time). Basically before the NPC is used (whether by the person that created it or by someone looking to borrow it) they would have to ask your permission first. And to prevent anyone from cheating with that, there could be a rule in place where your character can't interact with that NPC while you're controlling the NPC. That sound good?
Basically c3p-0h said what I said, but simpler XD