ACL question: is the topmost entry different ?

[Ace Suares <ace@suares.nl> (by way of Ace Suares <ace@suares.nl>)]

Hi,

I had the following acl:

access to dn="app=qwido"
	by dn="app=qwido" read
	by anonymous auth
	by * none

when I logged in as dn: oc=isp001,app=qwido, I could view the whole tree.
I expected to be able to see *nothing* at all !

Then I changed the acl to:

access to dn="app=qwido"
	by self read
	by anonymous auth
	by * none

Now, I couldn't see the whole three, but I could only see the entry
"oc=isp001,app=qwido".

I can understand the second ACL, but am confused about the first !

Greetings,
Ace