The target must be either the DN of the currently selected entry, or a direct
or indirect child of the currently selected entry. Remember, the ACI you
define applies to the target entry and all subentries in the directory tree. If
you use the suffix, for example, o=airius.com as the target, the ACI
applies to the entire directory tree.