![canonical](http://i.technet.microsoft.com/dynimg/IC213801.gif)

I found a [simple algorithm for building the canonical DACL](http://blogs.msdn.com/b/patcarna/archive/2009/02/09/the-access-control-list-is-not-canonical.aspx) should we ever need it.  OR, it appears that using the [SetEntriesInAcl](http://msdn.microsoft.com/en-us/library/windows/desktop/aa379576\(v=vs.85\).aspx) API call will also properly order the entries.

But back to the question of precedence around `SYSTEM` (given we're not adding deny entries which is really only necessary when a group is granted access but you wish to deny access to a user of that group)...

[This MSDN doc](http://technet.microsoft.com/en-us/library/cc961994.aspx) seems to indicate that adding `SYSTEM` first is the correct order.