# `Macaw.Data.Derived.Sandbox.Allowlist`
[🔗](https://github.com/dcoai/macaw_data/blob/v0.5.3/lib/macaw/data/derived/sandbox/allowlist.ex#L1)

What a stored derived-source function may call (spec/02 §6.2, visualize D-194): the allowlist
visualize#643 decided on 2026-10-15, as **explicit** `{function, arity}` lists — never "a module
minus a few".

Each module's allowed list and its excluded list together are exactly its exports on
Elixir 1.20.4 and OTP 29; the test suite holds them to it, so a function a new Elixir
adds fails that test until it is reviewed and listed. `Macaw.Data.Ops` is the library's
own and held the same way: through it a stored function reaches the registered transforms
and aggregates by literal name, and which ones is the registry's, never a list here
(spec/04 §6). Ported from visualize's `Visualize.VirtualSource.Sandbox.Allowlist`.

# `allowed`

```elixir
@spec allowed(module()) :: [{atom(), arity()}]
```

A module's allowed `{function, arity}` list; `[]` for a module not on the list.

# `excluded`

```elixir
@spec excluded(module()) :: [{{atom(), arity()}, atom()}]
```

A module's excluded `{{function, arity}, reason}` list, `reason` one of
`:nondeterministic`, `:deprecated`, `:atoms` and `:internal`.

# `kernel`

```elixir
@spec kernel() :: [{atom(), arity()}]
```

The `{function, arity}` of every `Kernel` function and operator, and every special form
at `Kernel.SpecialForms`' arity, a stored function may use.

# `modules`

```elixir
@spec modules() :: [module()]
```

The modules a stored function may call, in order (spec/02 §6.2).

---

*Consult [api-reference.md](api-reference.md) for complete listing*