A domain specification system for an LDAP ACI entry provides a system for specifying an ACI domain entry in an access control command line that controls access to a resource. The access control command specifies resources using a Universal Resource Locator (URL) format that contains the name of the resource. A target scope value specifies the scope of access to be granted to a user which can be limited to a single entry, a subtree, or a single level. A search filter is part of the resource specification. The ACI applies only to entries in the subtree rooted at the resource name that match the filter. A list of attributes is also contained in the resource specification and the ACI applies only to attributes in the resource that are named in the list. The access control command specifies the type of access to be granted to a user which includes, but is not limited to: deny, read, write, and any other privileges that the system supports. The access control command also specifies the required user attributes for access to a resource. The directory server matches the required attributes with the accessing user's attributes and grants the type of access listed only if the user has the required attributes.