/ACL[=(ace[,...])]

    Identifies one or more access control list entries (ACEs) to
    add, replace, or delete. Enclose each ACE in parentheses and
    separate multiple ACEs by commas (,).  The most common type of
    entry, the Identifier ACE, has the format (IDENTIFIER=identifier,
    ACCESS=access-type(+...)). By default, SET SECURITY adds an ACE
    to the top of the ACL. This behavior changes when you include one
    of the positional qualifiers: /AFTER, /DELETE, or /REPLACE. See
    the discussion of ACL ordering in the VSI OpenVMS Guide to System
    Security.