dn: cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
changetype: modify
add: aci
aci: (target ="ldap:///cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config")(targetattr != "aci || connection")(version 3.0; acl "monitor3"; allow( read, search, compare ) userdn = "ldap:///anyone";)

Odd, but when I try to apply the above ldif, I get "ldap_modify: Server is unwilling to perform (53)”. 

If I stop the server and modify dse.ldif manually, it does seem to work.