Thank you very much for your reply.
See the "<control>" field in slapd.access(5); for example (RE22/HEAD):
access to * by dn.exact="cn=foo" =rw continue by peername.ip="127.0.0.1" +0 stop by * auth
gives "rw" (read + write) access to "cn=foo", and confirms it if the request comes from "127.0.0.1" (the "break" is redundant, of course); otherwise, privileges are reset to "auth", which applies to "*".
Thank you very much