how to manage ACI in OID 11g?

IHAC who wants to have 2 users with extra privileges

user 1 : This user will  be able to browse, add, delete all the rest of users

user 2: This user can read the cn attribute

The general rule at root level i, by default, :
    

Entry filter	By whom	Bind Mode	Operator	Attribute	Read	Search	Write	Selfwrite	Compare
	Everyone	None	=	*	Granted	Granted	Denied	Unspecified	Granted

 

They would like to know how to do it .

do they have to remove the general rule?

and how can they create the aci?

We have already tested to create

dn: cn=Users2, dc=gobcantabria,dc=es

changetype: modify