What does ACTRL_DS_CONTROL_ACCESS do?

So saith MSDN:

Access allowed only after extended rights checks supported by the object are performed. This flag can be used alone to perform all extended rights checks on the object or it can be combined with an identifier of a specific extended right to perform only that check.

What is "Extended right checks"?

 

Anyways it doesn't look like something that should get into the Security Dialog for AD object.