on-the-fly tweaking of AccessControl (be_acl)

[Daniel <deepee@gmx.net>]

Dear slapd-Experts,

I've a perhaps slightly strange question regarding tweaking of be_acl 
from within an overlay and would be very happy if you could please help me.

I'm looking after a possibility to change AccessControl struct's content 
on "overlay-operation-basis": For each processed Operation within my 
test overlay I want to modify this sample ACL from a) into b):

a) cn=config initially stores:
access to filter=(x=*)
 by users read
 by * none

b) overlay has detected operation "z" ==> the acl should be tuned into:
access to filter=(y=*)
 by users read
 by * none

I think I've already found the concerned structs and I'm able to get the 
above modification done in theory, but I'm a little bit afraid/unsure 
regarding side effects, e.g thread locking and so on. I could imagine 
that in general be_acl is not intend to be changed from one operation to 
another...?!

What would be the "best" pseudo-code-style way to achive the above 
a-b-transition in a safe/consistent way from within an overlay?

Many thanks for your advice!

Cheers
Daniel