Directory Server- Attribute exclusion via aci

 we want to mask certain attributes from users, so thwey cannot ascertain such information, but we need the same attributes to be visible via a special update user, that will be used
to add.subtract entries and modify any attribute in the directory. How can we do it.