ACI for single user access

[James Chamberlain]

I'm trying to figure out how to write an ACI which would allow one  
user to read a particular branch of the directory, but deny all  
others.  If I specify it as two rules - one denying access to  
everyone, the other granting access to this user - no one can read  
that branch.  If I specify it as a single rule, that this user can  
read this branch, it's not imposing any new restrictions and everyone  
can read the branch.  I've tried reading the documentation and didn't  
see this example listed.  Can anyone point me in the right direction?

Thanks,

James