(type, option_flags, access_to_grant)

    The access-to-grant field indicates what type of access is to
    be granted, and (depending on the type of ACE) whether or not to
    log successful attempts or unsuccessful attempts to access the
    object. You can specify any access that is valid for the object
    class. Include the keywords SUCCESS, FAILURE, or both.