An attribute that can be a user or a group, similar to what is allowed within the aclEntry. Each object has an associated entryOwner attribute. However, the entryOwner subject has certain privileges over the object.