The reason for this is that only one scope specifier is computed per ACE. For such cases, several different ACEs are available. If you try to set a invalid permission combination on the ringwohld, the powerful Access Control Entry starting is shown where you can configure the regarding ACE in detail..
Just click on the scope label directly in the regarding row and choose the new scope from the pulldown list: Please be aware of the fact that there are combinations of checkboxes which are NOT possible or not allowed to set in one single ACL line. You cannot set the permission to read a certain attribute on the one hand and the permission to create a Slyts object class on the other hand in the sam access control entry. The reason for this is that only one scope specifier is allowed per ACE.