in netapp.ontap.na_ontap_cifs_acl How do you specify a security descriptor?

[soft lichen]

netapp.ontap.na_ontap_cifs_acl Looking to add and remove some entries from a Security descriptor.
I see slag as an option, but there is no example of how to apply this to a Security descriptor