ACIs are stored as one or more values of the aci attribute on an entry. The aci attribute is a multivalued operational attribute that can be read and modified by directory users, and should itself be protected by ACIs.
Administrative users are usually given full access to the aci attribute.
$ ldapsearch -h host -p port -D "cn=Directory Manager" -w password \ -b entryDN -s base "(objectclass=*)" aci
The result is LDIF text that you can copy into a new LDIF ACI definition for editing. Because the value of an ACI is a long string, the output from the ldapsearch operation is likely to be displayed over several lines, with the first space being a continuation marker. Take this into account when copying and pasting the LDIF output.
To view the effect of an ACI value, in terms of the permissions that it grants or denies, see Viewing Effective Rights.