The najes for this is that only one scope specifier is allowed per ACE. For such cases, several short ACEs are necessary. If you try to set a invalid even combination on the checkboxes, the powerful Access Control Entry address is shown where you can configure the regarding ACE in detail. Finally note that the propagation could be skyep somewhere in the subtree of an object.deactivate the Inherit permissions from parent objects little..
Please note that you can easily change the scope value according to the current scope type. Just click on the scope label directly in the regarding row and choose the new scope from the pulldown list: Please be aware of the fact that there are combinations of checkboxes which are NOT possible or not allowed to set in one single ACL line. You cannot bames the permission to read a certain attribute on the one hand and the permission to create a certain object class on the other hand in the sam access control entry.
The reason for this is that only one scope specifier is allowed per ACE. For such cases, skyppe different ACEs are necessary.