/REPLACE=(ace[,...])

    Eliminates entries listed with the /ACL qualifier and adds
    entries listed with the /REPLACE qualifier. SET SECURITY inserts
    the entries listed with /REPLACE in the position of the last
    deleted ACE.