externalize method whitelist