authorization white list method