An action allowlist is a predefined set of operations that a program or automated agent is permitted to perform. Rather than granting broad access, a system can restrict an agent to specific actions, such as reading approved data or submitting a limited type of request. Actions not on the list should be blocked.
In cyber security, allowlists help contain mistakes and misuse by limiting what software can do, even if its instructions or inputs are manipulated. For AI agents and other automation, this can restrict access to tools, accounts, or networked systems. Defenders should pair an allowlist with least-privilege permissions, activity logging, and human approval for high-impact actions; an overly broad or poorly enforced list may provide little protection.