I was thinking the `acl` type would have a property for managing the [`control`](http://msdn.microsoft.com/en-us/library/windows/desktop/aa379566(v=vs.85\).aspx) fields of the security descriptor, e.g. to mark the descriptor as protected so no inherited ACEs would filter through.

However, the `control` field is part of the `SecurityDescriptor`, so it's probably best to tackle that issue with a separate `sd` type to be implemented at a later time, something like:

<pre>
sd { &lt;name>:
  control => 0x....,
  dacl    => ACL[&lt;name>],
  sacl    => ACL[&lt;name>]
}
</pre>