want to write a startup policy to pick roles havin childrole

I have a requirement where I need to write a start-up policy to pick
nrfChildRoles like cn=abc,ou=aa... of nrfRoles.

I am writing this policy on loopback driver of IdVault.

Which I am getting from Apache LDAP browser by setting filter as (