Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.
Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
Expose management hidden attribute lists through bootstrap environment defaults and keep ACL rendering in the LDIF template. Align management assets with database-readonly naming and drop the MONITOR and AUDITLOG flag suffixes.
Update documentation, migration notes and integration coverage for custom hidden attributes, empty effective lists, audit logging and monitoring.
Load a targeted pwdHistory deny rule only when ppolicy and the data read-only
account are enabled. Continue normal ACL evaluation for other identities so
administrator access, replication and later custom grants remain available.
Add regression scenarios for default permissions, disabled features, replicated
history and password reuse, custom grants and bootstrap fragment replacement.
Document that existing databases require an explicit ACL update.
Bertrand Gouny