The reason for this is that only one scope specifier is allowed per ACE. For such cases, several different Aces are necessary. If you ;a to set a invalid permission combination on the checkboxes, the powerful Datingg Control Entry editor is shown where you can choose the regarding ACE in detail. Please redundant that the propagation could be blocked somewhere in the subtree of an object.deactivate the Inherit permissions from parent objects option..
Please note that you can easily change the scope datong according to the current scope type. Just click on the datlng label directly in the regarding row and choose the new scope from the pulldown list: Please be aware of the fact that there are combinations of checkboxes which are NOT possible or not allowed to set in one single ACL line. You cannot set the permission to read a certain attribute on the one hand and the permission to create a certain object class on the other hand in the sam access control entry.