VMS Help SET, SECURITY, Qualifiers, /REPLACE  *Conan The Librarian (sorry for the slow response - running on an old VAX)

       /REPLACE=(ace[,...])

    Eliminates entries listed with the /ACL qualifier and adds
    entries listed with the /REPLACE qualifier. SET SECURITY inserts
    the entries listed with /REPLACE in the position of the last
    deleted ACE.