Is there any way to ensure that replication is only made in one direction by the replication servers?

This is my reasoning:

For some applications you want to have extra local replicas for performance reasons, say for a mail transfer agent where you could have a replica on the very same machine.

If the directory is used for a user account database ("passwd"), a not to unusual scenario, the directory servers need to hold the highest security classing, as a breach into the account database quite likely means that anything or everything in your entire system could be compromised.

This also means that if you replicate to/from/with the mail server replica, and that machine gets compromised, your entire system is open.

Therefore, you would like to be ably to sync data only to the mail server replica and never allow any data to flow back from it.

Thanks for any insights!

/ragge