iis.rb

def add_acl app_path, desiredFilesystemRights, groupOrAccountName
  di = DirectoryInfo.new app_path
  ds = di.GetAccessControl

  simple_rule = FileSystemAccessRule.new(
    groupOrAccountName, 
    desiredFilesystemRights,
    AccessControlType.Allow
  )

  full_rule = FileSystemAccessRule.new(
    groupOrAccountName, 
    desiredFilesystemRights,
    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
    PropagationFlags.InheritOnly,
    AccessControlType.Allow
  )

  #Both rules need to run to give rights
  ds.AddAccessRule(simple_rule)
  ds.AddAccessRule(full_rule)

  Directory.SetAccessControl app_path, ds
  puts "Gives #{groupOrAccountName} #{desiredFilesystemRights} to #{app_path}"
end

As discussed on the mailing list: http://www.ruby-forum.com/topic/212515