A named set of addresses permitted to perform an action, with everything not on the list refused by default.
Why it matters
Deny-by-default is a stronger posture than block-the-known-bad, and withdrawal allowlists are one of the few controls that limit the damage of a compromised account rather than trying to prevent the compromise. The control is only as good as the process for adding entries to it.
What you can check
Where a service offers withdrawal allowlisting, the useful details are whether a newly added address is subject to a delay before it can be used, and what is required to add one. On-chain allowlists are readable directly, along with whoever holds the power to amend them.
Where it showed up
Records in the Incident Tracker that turn on this: Munchables insider key compromise.
Not advice. Definitions are for understanding, not instruction. Nothing here is financial, legal, tax or security advice.