An allowlist, long called a whitelist, permits only named subjects and denies everything else, and the newer name avoids a loaded color metaphor.
The naming shift does not change the control: if it is not on the list, it is not allowed.
How it works
People used the older color term for the same rule in mail, applications, and firewalls.
Many organizations now say allowlist because the rule is about permission, not about a metaphor.
A list still needs owners who add and remove entries.
Left alone, it either blocks real work or grows so wide that it stops being a control.
Concrete examples
- A mail server accepts messages only from partners named on the list.
- An application server runs only signed programs that appear on the allowlist.
- A firewall permits outbound connections only toward named update services.
Protective measures
- Use the word allowlist in new policy, screens, and training.
- Review entries on a schedule and remove what no current process needs.
- Log denials so legitimate work is added deliberately rather than by a broad exception.
- Refuse a wide entry that exists only to silence an alert.
Related articles
What is zero trust security? pairs this default deny habit with fresh checks on every sensitive request.
Where does a web application firewall sit? can enforce a narrow set of allowed request shapes in front of an application.
What is wireless network security? uses a similar permit list idea when only known devices should join a radio network.