There are three major roles in eDirectory that you need to clearly define:
eDirectory administrator: Complete access rights to the tree.
RADIUS administrator: Complete access only to the RADIUS container and users.
The eDirectory administrator can grant the RADIUS administrator rights to read the universal password of all users under a container C by granting the administrator inheritable write rights to the ACL attribute of C.
After integrating eDirectory with FreeRADIUS, the RADIUS administrator needs to be given rights to read the login details of the RADIUS users. So, the RADIUS administrator has to be trusted with such rights.
RADIUS and eDirectory users: Access rights as defined by the eDirectory administrator to all of their own attributes. Access to RADIUS attributes is not required.