I think what's intended is neither a whitelist nor a blacklist, but just a list.

I can make one of those, specifying exactly what models and fields are permitted, and nothing else. So then it's like having a whitelist with a "deny all others" as the blacklist.

if I'm going in there to fiddle with the configuration stuff, I may as well make it work the way we need it to work