Several <WHAT> statements can be used

Quoting SLAPD.ACCESS(5):

The dn, filter, and attrs statements are additive [..]

Example: to dn.subtree="dc=ldap1,dc=example,dc=org" attrs=userPassword,shadowLastChange by dn.exact="cn=replicator,dc=ldap1,dc=example,dc=org"