An allowlist is a list of items that are explicitly approved, such as destinations a server may connect to, users who may sign in, addresses that may reach a service or input values an application will accept. Anything not on the list is denied by default. It is sometimes written as allow list, and it is the opposite approach to a blocklist, which permits everything except what is listed.
Allowlists are useful because they limit what is possible even when a flaw exists. For example, restricting which hosts a server can contact outwards, or which values a field will accept, reduces what an attacker can reach or send through a vulnerable component. Because unknown items are refused, new or unexpected behavior is blocked until someone approves it.
An allowlist is not a fix for a vulnerability and is only as good as its contents. If it is too broad, it adds little protection, and if it is not maintained, legitimate changes can break services while outdated entries remain. Matching rules also need care, since a loosely written entry can allow more than intended.
To use one well, keep it as short and specific as practical, review it periodically, record why each entry exists and test that unlisted items are really refused. Combine it with patching and other controls, rather than relying on it alone.