Cfengine 3 example unit_acl_secret.html
body common control
{
bundlesequence => { "acls" };
}

#########################################

bundle agent acls

{
files:

 windows::

  "c:\Secret"
    acl => win,
    depth_search => include_base,
    comment => "Secure the secret directory from unauthorized access";
}

#########################################

body acl win

{
acl_method => "overwrite";
aces => { "user:Administrator:rwx" };
}

#########################################

body depth_search include_base

{
include_basedir => "true";
}
}