I think that this should be a separate ticket. Our use cases right now are:

1. when mode is managed, then create a brand new DACL with only ACEs we specify. None of the ACEs are denies, and we are currently putting explicit ACEs before inherited ones, e.g. CreatorOwner/Group comes last.
1. when mode is not managed, copy the existing DACL, preserving the ACE order, changing the SID from old owner/group to new one. There is one issue here in that we are currently dropping INHERIT_ONLY_ACEs and we need to not do that.