Ability to whitelist/blacklist terminal commands "from the outside"

Our use-case is non-interactive, so we'd like to be able to pass in a list of commands (or command patterns) that are always allowed.