OPTION=PROTECTED

    Protects the ACE against casual deletion. Protected ACEs can be
    deleted only by the following methods: by using the ACL editor;
    by specifying the ACE explicitly when deleting it-for example,
    use the command SET SECURITY/ACL=(ace)/DELETE; or by deleting
    all ACEs, both protected and unprotected, using the command SET
    SECURITY/ACL/DELETE=ALL.