Let TO be the object from which the allowedChildClasses attribute is being read.
The value of TO!allowedChildClasses the set of lDAPDisplayNames read from each Object O where
(O.distinguishedName is in the schema NC)
and (O!objectClass is classSchema)
and (not O!systemOnly)
and (not O!objectClassCategory is 2)
and (not O!objectClassCategory is 3)
and (there exists C in TO!objectClass such that C is in POSSSUPERIORS(O))