A security and governance control that specifies the only permitted tools, APIs, and actions an AI agent is allowed to execute.
Unlike a blacklist (which bans known bad actions), a whitelist uses an allow-list approach where everything is prohibited by default. This Bounded Action Space ensures an agent can only interact with pre-approved systems and within specific impact limits (e.g., a maximum dollar amount per transaction), preventing the agent from discovering and using unauthorized tools at runtime.
An AI customer service agent is whitelisted to access the Returns Database and Refund API, but it is strictly barred from accessing the Employee Payroll system or the Global Pricing table.
