Is this what we want?  If Puppet manages mode, we flush any other existing ACEs?