PERMISSIONS AND ACCESS CONTROL

ALLOW-LISTS AND DENY-LISTS An allow-list names exactly the things that are permitted, and everything else is refused. A deny-list names the things that are forbidden, and everything else is permitted. The difference is profound. An allow-list says only these people may enter. A deny-list says everyone may enter except these people. For security, allow-lists are generally stronger because you cannot predict every dangerous thing in advance. A deny-list always leaves open the dangerous item you forgot to list. Deny-lists still have a role, as an extra layer that blocks known-bad items, such as specific destructive commands, even inside an otherwise allowed tool. PRACTICAL POINTS Allow-lists apply to many things: tool names, file paths, network domains, email recipients, command names, and even specific arguments. Matching must be exact and careful, because attackers hide tricks in path notation, capital letters, or encoded characters. For example, a rule allowing the folder "reports" must not accidentally allow "reports_secret" or a path that climbs out of the folder using parent-directory notation. A good practice is to normalize and resolve a path to its true full form before checking it against the allow-list.