Hi Alistair,
I'd suggest adding a "dna_confirmation" tag to your post, in case someone is following that tag/feed and may be able to help.
Here's what I do ...
I have encountered DNA matches for which the DNA test results are attached to the wrong person in a tree. So I usually reach out to contact DNA matches (if I haven't already) that I intend to use for confirming relationships at WikiTree. If they respond and confirm their knowledge of their relationship to a close deceased sourced ancestor (such as their parent/grandparent) in their line to the MRCA(s), I accept that "personal recollection" as evidence. If they don't respond, and if I'm unable to find evidence (obituaries or other sources) confirming the relationship(s) in question, then I don't use the match for confirming here.
For confirmations here for which the match is not a WikiTree member, I usually build/source the relationships down toward the match in their line from the MRCA(s), but I generally stop before creating profiles for any living individuals, since I have no desire to manage privacy-locked profiles other than the profiles of my close relatives. I confirm all the relationships between me and the MRCA(s), and I generally confirm all the relationships between the match's nearest deceased ancestor and the MRCAs(s).
In the DNA confirmation statement for such a match, I usually protect the match's privacy by referring to them as "a grandchild of <their deceased grandparent>". While I believe it is permissible here, I don't personally like to use initials of living people.