access to attrs=*
       by group.exact="cn=phone,ou=groups,dc=example,dc=com"
       by users      read
       by *          none