To configure the 'cn=config' backend:

slapd.conf:

database config
# define a user
rootdn "cn=Manager,cn=config"
rootpw secret

# maybe you want to let everyone read it.  Probably not.
access to dn.base="cn=config"
        by * read

In OpenLDAP 2.3 the config backend does not use ACLs, it simply restricts access to only its rootdn.

In OpenLDAP 2.4 the config backend uses ACLs like any other backend does.