ACL I just don't get it...

Hi all, I've got the following problem: We've defined a location objectClass with a multi-value attribute "itAdmin". Underneath the locations we have all our users. On the user object we have an attribute called "distinctMail". Now all itAdmins, defined on the location above the user, should have write access to this user attribute. But I don't know how to set the correct acl settings in slapd.conf... any hints? I'm using openLDAP 2.2.6 on a SuSE 9.1 box. Thanks in advance! Christoph