Syntax:

      /[NO]DENY = privileges

  /DENY enumerates the privileges denied to the  specified  user(s)  at
  the  current  dictionary  directory,  subdictionary,  or  object.  In
  addition, denied privileges extend to descendants, but  they  can  be
  granted  again  at  lower levels in the hierarchy.  /NODENY specifies
  the privileges that are not denied.  The specification of a privilege
  in  /NODENY  overrides  the  specification  of  the same privilege in
  /DENY.

  The most common use for the combination of the two qualifiers  is  in
  an  example like "/DENY=ALL/NODENY=(PASS,SEE)", where it is easier to
  enumerate the privileges that are not denied than to do the opposite.

  Type "HELP specify privileges" for further information.