VMS Help SET, SECURITY, Qualifiers, /ACL  *Conan The Librarian (sorry for the slow response - running on an old VAX)

       /ACL[=(ace[,...])]

    Identifies one or more access control list entries (ACEs) to
    add, replace, or delete. Enclose each ACE in parentheses and
    separate multiple ACEs by commas (,).  The most common type of
    entry, the Identifier ACE, has the format (IDENTIFIER=identifier,
    ACCESS=access-type(+...)). By default, SET SECURITY adds an ACE
    to the top of the ACL. This behavior changes when you include one
    of the positional qualifiers: /AFTER, /DELETE, or /REPLACE. Refer
    to the discussion of ACL ordering in the OpenVMS Guide to System
    Security.