Add note about "auth" access requirement for authz-regexp

doc/guide/admin/sasl.sdf

@@ -483,6 +483,10 @@ Note that the explicitly-named realms are handled first, to avoid
 the realm name becoming part of the UID.  Also note the use of scope
 and filters to limit matching to desirable entries.
 
+Note as well that {{EX:authz-regexp}} internal search are subject
+to access controls.  Specifically, the authentication identity
+must have {{EX:auth}} access.
+
 See {{slapd.conf}}(5) for more detailed information.