Token allowlisting is a control that restricts activity in a digital token to a pre-approved list. In its most common sense, the issuer of a token records the wallet addresses of investors who have passed know your customer and eligibility checks, and the token's smart contract rejects any transfer to an address that is not on the list. This is how tokenized securities, fund units and some stablecoins keep ownership within the set of holders the law allows, even on a public blockchain. Permissioned token standards such as ERC-3643 build in this check.
The term is also used inside custody operations for the list of tokens and contracts that a firm has reviewed and approved for its wallets to hold or interact with. Both uses form part of wallet governance. An allowlist is the same idea as a whitelist; the newer word is preferred in technical standards.