While working on new tests for dj proxy with production mode enabled during installation, I noticed that it removes a global access control policy "Authenticated access all entries". However this policy is necessary for operations like Pre-Read and Post-Read controls, the Subtree Delete control, and the Permissive Modify control. Which is explicitly mentioned in Installation guide in description of --productionMode parameter. link => DS Setup Proxy
When I added this policy like this policy example , the pre-read control works as expected.
From my point of view, it is not big problem, however the documentation shouldn't mention this in proxy installation guide. Other sections of installation guide should be reviewed according to this. A description of --productionMode parameter is same for installation of directory-server, replication-server and proxy-server.