note that the replication identity may need to be treated specially by the consumer

doc/man/man5/slapd.conf.5

@@ -1664,6 +1664,12 @@ option. A non default SASL realm can be set with the
 .B realm 
 option.
 
+The provider, other than allow authentication of the syncrepl identity,
+should grant that identity appropriate access privileges to the data 
+that is being replicated (\fBaccess\fP directive), and appropriate time 
+and size limits (\fBlimits\fP directive).
+
+
 The
 .B starttls
 parameter specifies use of the StartTLS extended operation