I have a number of objects scattered around my DIT that I want to dynamically "tag" for access by a certain user by giving them a memberOf attribute pointing to that user. Now here's the fun part: Is it possible to also give that user access to the subtree starting at the "tagged" object? E.g. I have an office manager who manages a random number of rooms around the building. I assign the rooms to him via memberOf, but the rooms also have people in them that he should have access to. For that I would need something like this: access to filter.subtree="(memberOf=managerguy)" by managerguy read Is there any way to do this today? Otherwise make it a feature request :) -- Torsten Rehn