By default, the entry targeted by an ACI containing a targetattr keyword is the entry on which the ACI is placed. That is, if you apply the ACI aci: (targetattr = "uid")(accessControlRules;) to the ou=Marketing, dc=example,dc=com entry, then the ACI applies to the entire Marketing subtree. However, you can also explicitly specify a target using the target keyword, as shown in the following example:
aci: (target="ldap:///uid=*,ou=Marketing,dc=example,dc=com") (targetattr="uid") (accessControlRules;)
The order in which you specify the target and the targetattr keywords is irrelevant.