Can restrict by: Distinguished Name Filter that matches some attributes Attributes Can restrict with: Anonymous users Authenticated users Self - ie, user who owns the entry Distinguished name IP address or DNS entry Access control priority: Local database Global rules Runs thru in order the rules appear in the config file First matching rule is used