Enforce whitelist for all access, not just lists