Last updated:
A security and governance control that specifies the only permitted tools, APIs, and actions an AI agent is allowed to execute.
Unlike a blacklist (which bans known bad actions), a whitelist uses an allow-list approach where everything is prohibited by default. This Bounded Action Space ensures an agent can only interact with pre-approved systems and within specific impact limits (e.g., a maximum dollar amount per transaction), preventing the agent from discovering and using unauthorized tools at runtime.
Real world example:
An AI customer service agent is whitelisted to access the Returns Database and Refund API, but it is strictly barred from accessing the Employee Payroll system or the Global Pricing table.
