The following ACI allows an employee's manager to edit the value of the employee's telephoneNumber attribute. This ACI uses the userattr keyword with a bind type of USERDN, which indicates that the target entry’s manager attribute must have a value equal to the distinguished name (DN) of the authenticated user.

aci: (targetattr="telephoneNumber")
(version 3.0; acl "A manager can update telephone numbers of her direct reports";
allow (read,search,compare,write) userattr="manager#USERDN";)