Glossary
Updated
Unlike a blacklist (which bans known bad actions), a whitelist uses an allow-list approach where everything is prohibited by default. This Bounded Action Space ensures an agent can only interact with pre-approved systems and within specific impact limits (e.g., a maximum dollar amount per transaction), preventing the agent from discovering and using unauthorized tools at runtime.
Example
An AI customer service agent is whitelisted to access the Returns Database and Refund API, but it is strictly barred from accessing the Employee Payroll system or the Global Pricing table.