You want to determine if an object has the permissions defined in the schema for its object class as part of its ACL.
126.96.36.199 Using a command-line interface
> acldiag <ObjectDN> /schema
For more on the default security descriptor, see Recipe 14.11.
14.12.4 See Also
Recipe 14.13 for resetting an object's ACL to the default defined in the schema