olcAccess with combined "by who" condition