Help with ACLs

["David Clarke" <pigwin32@gmail.com>]

Hello and apologies if I'm posting this in the wrong location.

I'm trying to apply some security to my openldap repository and I'm
struggling with how or even if I can express a particular constraint.

I have an ou containing inetOrgPerson's and the person's "o" attribute
is the string value of the organisation "o" to which the user belongs,
e.g. "Some Company Ltd".

e.g. dn=uid=12345679,ou=people,dc=thecompany,dc=co,dc=nz attr o=Some Company Ltd

The organisation "Some Company Ltd" can have subsidiary organisations,
specified by the "owner" attribute of the subsidiary having the "dn"
of owner organisation.

e.g. dn: o=Subsidiary Company
Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz having attr
owner:o=Some Company Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz

What I would like to do is restrict the user to having read access
only to those subsidiary organisations based on the value of the
user's "o" attribute. Is this a reasonable approach or should I be
expressing this differently in my schema?

I hope I've expressed that reasonably clearly. Any help would be much
appreciated.