OPTION=HIDDEN

    Indicates that this ACE should be changed only by the application
    that adds it. Although the HIDDEN option is valid for any ACE
    type, its intended use is to hide application ACEs. The ACL
    editor displays the ACE only to show its relative position within
    the ACL, not to facilitate editing of the ACE. Unless you have
    the SECURITY privilege, you cannot display a hidden ACE with the
    DCL command DIRECTORY/ACL.

    You cannot display a hidden ACE with the DCL commands SHOW
    SECURITY or DIRECTORY/SECURITY, and you cannot modify or delete a
    hidden ACE with the SET SECURITY command. To create a hidden ACE,
    an application can invoke the $SET_SECURITY system service.