docs: state the empty DACL that Clear-NTFSAccess -DisableInheritance leaves

The behavior stays: the cmdlet removes the explicit entries and disables
inheritance without copying the inherited ones. The parameter text now
states the empty DACL and its risk, and a test pins the behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

Docs/Cmdlets/Clear-NTFSAccess.md

@@ -72,7 +72,7 @@ These commands replace the complete ACL of `C:\Data` in one write. The security
 
 ### -DisableInheritance
 
-Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. Without this switch the inherited entries remain in effect.
+Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. The item is left with an empty DACL, which denies access to everyone; only its owner can still change the permissions. Without this switch the inherited entries remain in effect.
 
 ```yaml
 Type: SwitchParameter

NTFSSecurity/en-US/NTFSSecurity.dll-Help.xml

@@ -1601,7 +1601,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none">
           <maml:name>DisableInheritance</maml:name>
           <maml:description>
-            <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. Without this switch the inherited entries remain in effect.</maml:para>
+            <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. The item is left with an empty DACL, which denies access to everyone; only its owner can still change the permissions. Without this switch the inherited entries remain in effect.</maml:para>
           </maml:description>
           <dev:type>
             <maml:name>SwitchParameter</maml:name>
@@ -1628,7 +1628,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
         <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none">
           <maml:name>DisableInheritance</maml:name>
           <maml:description>
-            <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. Without this switch the inherited entries remain in effect.</maml:para>
+            <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. The item is left with an empty DACL, which denies access to everyone; only its owner can still change the permissions. Without this switch the inherited entries remain in effect.</maml:para>
           </maml:description>
           <dev:type>
             <maml:name>SwitchParameter</maml:name>
@@ -1642,7 +1642,7 @@ PS C:\&gt; Set-NTFSSecurityDescriptor -SecurityDescriptor $sd</dev:code>
       <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none">
         <maml:name>DisableInheritance</maml:name>
         <maml:description>
-          <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. Without this switch the inherited entries remain in effect.</maml:para>
+          <maml:para>Indicates that inheritance is disabled after the explicit entries are removed, and that the inherited entries are discarded rather than copied into the item. The item is left with an empty DACL, which denies access to everyone; only its owner can still change the permissions. Without this switch the inherited entries remain in effect.</maml:para>
         </maml:description>
         <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue>
         <dev:type>

Tests/Access.Tests.ps1

@@ -285,3 +285,20 @@ Describe 'Security descriptor parameter sets' {
         $rule.InheritanceFlags | Should -Be ([System.Security.AccessControl.InheritanceFlags]::None)
     }
 }
+
+Describe 'Clear-NTFSAccess' {
+    Context 'With -DisableInheritance' {
+        # The cmdlet does not copy the inherited entries, so the item is left with an empty DACL. This is the
+        # documented behavior; Set-NTFSInheritance and Disable-NTFSAccessInheritance keep the entries.
+        It 'Should leave the item with an empty, protected DACL' {
+            $file = New-TestSandboxItem -Sandbox $sandbox -Name 'ClearAll'
+            Assert-TestSandboxPath -Sandbox $sandbox -Path $file
+
+            Clear-NTFSAccess -Path $file -DisableInheritance
+
+            $acl = Get-Acl -LiteralPath $file
+            $acl.AreAccessRulesProtected | Should -BeTrue
+            $acl.Access | Should -BeNullOrEmpty
+        }
+    }
+}