VMS Help CMS, SET, ACL, Qualifiers, /REPLACE=(ace[,...])  *Conan The Librarian (sorry for the slow response - running on an old VAX)

    Deletes the access control entries (ACEs) specified with the /ACL
    qualifier and replaces them with those specified with /REPLACE.
    Any ACEs specified with the /ACL qualifier must exist and must be
    specified in the order in which they appear in the current ACL.