diff --git a/src/main/java/com/google/devtools/build/lib/analysis/Whitelist.java b/src/main/java/com/google/devtools/build/lib/analysis/Allowlist.java
similarity index 63%
rename from src/main/java/com/google/devtools/build/lib/analysis/Whitelist.java
rename to src/main/java/com/google/devtools/build/lib/analysis/Allowlist.java
index 6d5f451..6485fd1 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/Whitelist.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/Allowlist.java
@@ -27,63 +27,65 @@
 import com.google.devtools.build.lib.packages.PackageSpecification.PackageGroupContents;
 
 /**
- * Class used for implementing whitelists using package groups.
+ * Class used for implementing allowlists using package groups.
  *
- * <p>To use add an attribute {@link getAttributeFromWhitelistName(String,Label) to the rule class
- * which needs the whitelisting mechanism and use {@link isAvailable(RuleContext,String)} to check
+ * <p>To use add an attribute {@link getAttributeFromAllowlistName(String) to the rule class
+ * which needs the allowlisting mechanism and use {@link isAvailable(RuleContext,String)} to check
  * during analysis if a rule is present
  */
-public final class Whitelist {
+public final class Allowlist {
 
-  private Whitelist() {}
+  private Allowlist() {}
 
   /**
    * Returns an Attribute.Builder that can be used to add an implicit attribute to a rule containing
-   * a package group whitelist.
+   * a package group allowlist.
    *
-   * @param whitelistName The name of the whitelist. This has to comply with attribute naming
+   * @param allowlistName The name of the allowlist. This has to comply with attribute naming
    *     standards and will be used as a suffix for the attribute name.
    */
-  public static Attribute.Builder<Label> getAttributeFromWhitelistName(String whitelistName) {
-    String attributeName = getAttributeNameFromWhitelistName(whitelistName);
+  public static Attribute.Builder<Label> getAttributeFromAllowlistName(String allowlistName) {
+    String attributeName = getAttributeNameFromAllowlistName(allowlistName);
     return attr(attributeName, LABEL)
         .cfg(HostTransition.createFactory())
         .mandatoryNativeProviders(ImmutableList.of(PackageSpecificationProvider.class));
   }
 
   /**
-   * Returns whether the rule in the given RuleContext *was defined* in a whitelist.
+   * Returns whether the rule in the given RuleContext *was defined* in a allowlist.
    *
    * @param ruleContext The context in which this check is being executed.
-   * @param whitelistName The name of the whitelist being used.
+   * @param allowlistName The name of the allowlist being used.
    */
   public static boolean isAvailableBasedOnRuleLocation(
-      RuleContext ruleContext, String whitelistName) {
+      RuleContext ruleContext, String allowlistName) {
     return isAvailableFor(
         ruleContext,
-        whitelistName,
+        allowlistName,
         ruleContext.getRule().getRuleClassObject().getRuleDefinitionEnvironmentLabel());
   }
 
   /**
-   * Returns whether the rule in the given RuleContext *was instantiated* in a whitelist.
+   * Returns whether the rule in the given RuleContext *was instantiated* in a allowlist.
    *
    * @param ruleContext The context in which this check is being executed.
-   * @param whitelistName The name of the whitelist being used.
+   * @param allowlistName The name of the allowlist being used.
    */
-  public static boolean isAvailable(RuleContext ruleContext, String whitelistName) {
-    return isAvailableFor(ruleContext, whitelistName, ruleContext.getLabel());
+  public static boolean isAvailable(RuleContext ruleContext, String allowlistName) {
+    return isAvailableFor(ruleContext, allowlistName, ruleContext.getLabel());
   }
 
   /**
-   * @param relevantLabel the label to check for in the whitelist. This allows features that
-   *     whitelist on rule definition location and features that whitelist on rule instantiation
+   * @param ruleContext The context in which this check is being executed.
+   * @param allowlistName The name of the allowlist being used.
+   * @param relevantLabel The label to check for in the allowlist. This allows features that
+   *     allowlist on rule definition location and features that allowlist on rule instantiation
    *     location to share logic.
    */
   public static boolean isAvailableFor(
-      RuleContext ruleContext, String whitelistName, Label relevantLabel) {
+      RuleContext ruleContext, String allowlistName, Label relevantLabel) {
     PackageSpecificationProvider packageSpecificationProvider =
-        fetchPackageSpecificationProvider(ruleContext, whitelistName);
+        fetchPackageSpecificationProvider(ruleContext, allowlistName);
     return isAvailableFor(packageSpecificationProvider.getPackageSpecifications(), relevantLabel);
   }
 
@@ -94,8 +96,8 @@
   }
 
   public static PackageSpecificationProvider fetchPackageSpecificationProvider(
-      RuleContext ruleContext, String whitelistName) {
-    String attributeName = getAttributeNameFromWhitelistName(whitelistName);
+      RuleContext ruleContext, String allowlistName) {
+    String attributeName = getAttributeNameFromAllowlistName(allowlistName);
     Preconditions.checkArgument(ruleContext.isAttrDefined(attributeName, LABEL));
     TransitiveInfoCollection packageGroup =
         ruleContext.getPrerequisite(attributeName, TransitionMode.HOST);
@@ -105,31 +107,31 @@
   }
 
   /**
-   * Returns whether the given label is in the whitelist provided.
+   * Returns whether the given label is in the allowlist provided.
    *
-   * @param whitelist the whitelist provided
-   * @param relevantLabel the label to check for in the whitelist.
+   * @param allowlist the allowlist provided
+   * @param relevantLabel the label to check for in the allowlist.
    */
-  public static boolean isAvailableForWhitelist(
-      TransitiveInfoCollection whitelist, Label relevantLabel) {
+  public static boolean isAvailableForAllowlist(
+      TransitiveInfoCollection allowlist, Label relevantLabel) {
     PackageSpecificationProvider packageSpecificationProvider =
-        whitelist.getProvider(PackageSpecificationProvider.class);
+        allowlist.getProvider(PackageSpecificationProvider.class);
     return isAvailableFor(packageSpecificationProvider.getPackageSpecifications(), relevantLabel);
   }
 
   /**
-   * Returns whether the rule from the given rule context has a whitelist by the given name.
+   * Returns whether the rule from the given rule context has a allowlist by the given name.
    *
    * @param ruleContext The rule context to check
-   * @param whitelistName The name of the whitelist to check for.
-   * @return True if the given rule context has the given whitelist.
+   * @param allowlistName The name of the allowlist to check for.
+   * @return True if the given rule context has the given allowlist.
    */
-  public static boolean hasWhitelist(RuleContext ruleContext, String whitelistName) {
-    String attributeName = getAttributeNameFromWhitelistName(whitelistName);
+  public static boolean hasAllowlist(RuleContext ruleContext, String allowlistName) {
+    String attributeName = getAttributeNameFromAllowlistName(allowlistName);
     return ruleContext.isAttrDefined(attributeName, LABEL);
   }
 
-  private static String getAttributeNameFromWhitelistName(String whitelistName) {
-    return String.format("$whitelist_%s", whitelistName);
+  private static String getAttributeNameFromAllowlistName(String allowlistName) {
+    return String.format("$whitelist_%s", allowlistName);
   }
 }
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/BUILD b/src/main/java/com/google/devtools/build/lib/analysis/BUILD
index 463a645..559b481 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/BUILD
+++ b/src/main/java/com/google/devtools/build/lib/analysis/BUILD
@@ -166,6 +166,7 @@
     name = "analysis_cluster",
     srcs = [
         "AliasProvider.java",
+        "Allowlist.java",
         "AnalysisEnvironment.java",
         "AnalysisFailureEvent.java",
         "AnalysisResult.java",
@@ -217,7 +218,6 @@
         "TargetContext.java",
         "TopLevelArtifactHelper.java",
         "Util.java",
-        "Whitelist.java",
         "WindowsBatchCommandConstructor.java",
         "WindowsPowershellCommandConstructor.java",
         "actions/ActionConstructionContext.java",
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/CommonPrerequisiteValidator.java b/src/main/java/com/google/devtools/build/lib/analysis/CommonPrerequisiteValidator.java
index eeb7b5c..61e88d0 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/CommonPrerequisiteValidator.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/CommonPrerequisiteValidator.java
@@ -18,7 +18,7 @@
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.cmdline.PackageIdentifier;
 import com.google.devtools.build.lib.packages.Attribute;
-import com.google.devtools.build.lib.packages.FunctionSplitTransitionWhitelist;
+import com.google.devtools.build.lib.packages.FunctionSplitTransitionAllowlist;
 import com.google.devtools.build.lib.packages.InputFile;
 import com.google.devtools.build.lib.packages.NonconfigurableAttributeMapper;
 import com.google.devtools.build.lib.packages.OutputFile;
@@ -118,7 +118,7 @@
               .contains("PackageSpecificationProvider");
       // TODO(plf): Add the PackageSpecificationProvider to the 'visibility' attribute.
       if (!attrName.equals("visibility")
-          && !attrName.equals(FunctionSplitTransitionWhitelist.WHITELIST_ATTRIBUTE_NAME)
+          && !attrName.equals(FunctionSplitTransitionAllowlist.ATTRIBUTE_NAME)
           && !containsPackageSpecificationProvider) {
         context.attributeError(
             attrName,
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleClassFunctions.java b/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleClassFunctions.java
index 71dd187..e9a3b8e 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleClassFunctions.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleClassFunctions.java
@@ -56,7 +56,7 @@
 import com.google.devtools.build.lib.packages.BuildSetting;
 import com.google.devtools.build.lib.packages.BuildType;
 import com.google.devtools.build.lib.packages.ExecGroup;
-import com.google.devtools.build.lib.packages.FunctionSplitTransitionWhitelist;
+import com.google.devtools.build.lib.packages.FunctionSplitTransitionAllowlist;
 import com.google.devtools.build.lib.packages.ImplicitOutputsFunction.StarlarkImplicitOutputsFunctionWithCallback;
 import com.google.devtools.build.lib.packages.ImplicitOutputsFunction.StarlarkImplicitOutputsFunctionWithMap;
 import com.google.devtools.build.lib.packages.Package.NameConflictException;
@@ -703,7 +703,7 @@
       // Thus far, we only know if we have a rule transition. While iterating through attributes,
       // check if we have an attribute transition.
       boolean hasStarlarkDefinedTransition = builder.hasStarlarkRuleTransition();
-      boolean hasFunctionTransitionWhitelist = false;
+      boolean hasFunctionTransitionAllowlist = false;
       for (Pair<String, StarlarkAttrModule.Descriptor> attribute : attributes) {
         String name = attribute.getFirst();
         StarlarkAttrModule.Descriptor descriptor = attribute.getSecond();
@@ -720,56 +720,54 @@
           }
           builder.setHasAnalysisTestTransition();
         }
-        // Check for existence of the function transition whitelist attribute.
-        // TODO(b/121385274): remove when we stop whitelisting starlark transitions
-        if (name.equals(FunctionSplitTransitionWhitelist.WHITELIST_ATTRIBUTE_NAME)) {
+        // Check for existence of the function transition allowlist attribute.
+        // TODO(b/121385274): remove when we stop allowlisting starlark transitions
+        if (name.equals(FunctionSplitTransitionAllowlist.ATTRIBUTE_NAME)) {
           if (!BuildType.isLabelType(attr.getType())) {
             throw new EvalException(
-                getLocation(), "_whitelist_function_transition attribute must be a label type");
+                getLocation(), "_allowlist_function_transition attribute must be a label type");
           }
           if (attr.getDefaultValueUnchecked() == null) {
             throw new EvalException(
                 getLocation(),
-                "_whitelist_function_transition attribute must have a default value");
+                "_allowlist_function_transition attribute must have a default value");
           }
           Label defaultLabel = (Label) attr.getDefaultValueUnchecked();
           // Check the label value for package and target name, to make sure this works properly
           // in Bazel where it is expected to be found under @bazel_tools.
           if (!defaultLabel
                   .getPackageName()
-                  .equals(FunctionSplitTransitionWhitelist.WHITELIST_LABEL.getPackageName())
-              || !defaultLabel
-                  .getName()
-                  .equals(FunctionSplitTransitionWhitelist.WHITELIST_LABEL.getName())) {
+                  .equals(FunctionSplitTransitionAllowlist.LABEL.getPackageName())
+              || !defaultLabel.getName().equals(FunctionSplitTransitionAllowlist.LABEL.getName())) {
             throw new EvalException(
                 getLocation(),
-                "_whitelist_function_transition attribute ("
+                "_allowlist_function_transition attribute ("
                     + defaultLabel
                     + ") does not have the expected value "
-                    + FunctionSplitTransitionWhitelist.WHITELIST_LABEL);
+                    + FunctionSplitTransitionAllowlist.LABEL);
           }
-          hasFunctionTransitionWhitelist = true;
-          builder.setHasFunctionTransitionWhitelist();
+          hasFunctionTransitionAllowlist = true;
+          builder.setHasFunctionTransitionAllowlist();
         }
         addAttribute(builder, attr);
       }
-      // TODO(b/121385274): remove when we stop whitelisting starlark transitions
+      // TODO(b/121385274): remove when we stop allowlisting starlark transitions
       if (hasStarlarkDefinedTransition) {
-        if (!hasFunctionTransitionWhitelist) {
+        if (!hasFunctionTransitionAllowlist) {
           throw new EvalException(
               getLocation(),
               String.format(
-                  "Use of Starlark transition without whitelist attribute"
-                      + " '_whitelist_function_transition'. See Starlark transitions documentation"
+                  "Use of Starlark transition without allowlist attribute"
+                      + " '_allowlist_function_transition'. See Starlark transitions documentation"
                       + " for details and usage: %s %s",
                   builder.getRuleDefinitionEnvironmentLabel(), builder.getType()));
         }
       } else {
-        if (hasFunctionTransitionWhitelist) {
+        if (hasFunctionTransitionAllowlist) {
           throw new EvalException(
               getLocation(),
               String.format(
-                  "Unused function-based split transition whitelist: %s %s",
+                  "Unused function-based split transition allowlist: %s %s",
                   builder.getRuleDefinitionEnvironmentLabel(), builder.getType()));
         }
       }
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleConfiguredTargetUtil.java b/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleConfiguredTargetUtil.java
index 7fff89b..d8830e5 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleConfiguredTargetUtil.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/skylark/StarlarkRuleConfiguredTargetUtil.java
@@ -20,6 +20,7 @@
 import com.google.devtools.build.lib.actions.Artifact;
 import com.google.devtools.build.lib.actions.MutableActionGraph.ActionConflictException;
 import com.google.devtools.build.lib.analysis.ActionsProvider;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.DefaultInfo;
 import com.google.devtools.build.lib.analysis.RuleConfiguredTargetBuilder;
@@ -28,7 +29,6 @@
 import com.google.devtools.build.lib.analysis.RunfilesProvider;
 import com.google.devtools.build.lib.analysis.RunfilesSupport;
 import com.google.devtools.build.lib.analysis.StarlarkProviderValidationUtil;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.test.CoverageCommon;
 import com.google.devtools.build.lib.analysis.test.InstrumentedFilesInfo;
 import com.google.devtools.build.lib.collect.nestedset.Depset;
@@ -38,7 +38,7 @@
 import com.google.devtools.build.lib.events.Event;
 import com.google.devtools.build.lib.packages.AdvertisedProviderSet;
 import com.google.devtools.build.lib.packages.BazelStarlarkContext;
-import com.google.devtools.build.lib.packages.FunctionSplitTransitionWhitelist;
+import com.google.devtools.build.lib.packages.FunctionSplitTransitionAllowlist;
 import com.google.devtools.build.lib.packages.Info;
 import com.google.devtools.build.lib.packages.NativeProvider;
 import com.google.devtools.build.lib.packages.NativeProvider.WithLegacyStarlarkName;
@@ -120,11 +120,11 @@
                 + " should have been specified by the requesting rule.");
         return null;
       }
-      if (ruleClass.hasFunctionTransitionWhitelist()
-          && !Whitelist.isAvailableBasedOnRuleLocation(
-              ruleContext, FunctionSplitTransitionWhitelist.WHITELIST_NAME)) {
-        if (!Whitelist.isAvailable(ruleContext, FunctionSplitTransitionWhitelist.WHITELIST_NAME)) {
-          ruleContext.ruleError("Non-whitelisted use of Starlark transition");
+      if (ruleClass.hasFunctionTransitionAllowlist()
+          && !Allowlist.isAvailableBasedOnRuleLocation(
+              ruleContext, FunctionSplitTransitionAllowlist.NAME)) {
+        if (!Allowlist.isAvailable(ruleContext, FunctionSplitTransitionAllowlist.NAME)) {
+          ruleContext.ruleError("Non-allowlisted use of Starlark transition");
         }
       }
 
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidBinaryRule.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidBinaryRule.java
index ac5e02a..013e4f4 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidBinaryRule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidBinaryRule.java
@@ -13,9 +13,9 @@
 // limitations under the License.
 package com.google.devtools.build.lib.bazel.rules.android;
 
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.RuleDefinition;
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.bazel.rules.cpp.BazelCppRuleClasses.CcToolchainRequiringRule;
 import com.google.devtools.build.lib.bazel.rules.java.BazelJavaRuleClasses;
 import com.google.devtools.build.lib.packages.RuleClass;
@@ -68,10 +68,10 @@
         <!-- #END_BLAZE_RULE.IMPLICIT_OUTPUTS --> */
         .setImplicitOutputsFunction(AndroidRuleClasses.ANDROID_BINARY_IMPLICIT_OUTPUTS)
         .add(
-            Whitelist.getAttributeFromWhitelistName("export_deps")
+            Allowlist.getAttributeFromAllowlistName("export_deps")
                 .value(environment.getToolsLabel("//tools/android:export_deps_whitelist")))
         .add(
-            Whitelist.getAttributeFromWhitelistName("allow_deps_without_srcs")
+            Allowlist.getAttributeFromAllowlistName("allow_deps_without_srcs")
                 .value(
                     environment.getToolsLabel(
                         "//tools/android:allow_android_library_deps_without_srcs_whitelist")))
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidLibraryRule.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidLibraryRule.java
index 5084040..3d0c116 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidLibraryRule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/BazelAndroidLibraryRule.java
@@ -14,9 +14,9 @@
 
 package com.google.devtools.build.lib.bazel.rules.android;
 
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.RuleDefinition;
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.bazel.rules.java.BazelJavaRuleClasses;
 import com.google.devtools.build.lib.packages.RuleClass;
 import com.google.devtools.build.lib.rules.android.AndroidLibraryBaseRule;
@@ -43,7 +43,7 @@
         .setImplicitOutputsFunction(AndroidRuleClasses.ANDROID_LIBRARY_IMPLICIT_OUTPUTS)
         .addRequiredToolchains(CppRuleClasses.ccToolchainTypeAttribute(env))
         .add(
-            Whitelist.getAttributeFromWhitelistName("allow_deps_without_srcs")
+            Allowlist.getAttributeFromAllowlistName("allow_deps_without_srcs")
                 .value(
                     env.getToolsLabel(
                         "//tools/android:allow_android_library_deps_without_srcs_whitelist")))
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
index 5d62b08..0273317 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
@@ -650,7 +650,7 @@
       boolean usingNativeSinglejar,
       // Explicitly ignoring params since Bazel doesn't yet support one version
       OneVersionEnforcementLevel oneVersionEnforcementLevel,
-      Artifact oneVersionWhitelistArtifact,
+      Artifact oneVersionAllowlistArtifact,
       Artifact sharedArchive) {
     return DeployArchiveBuilder.defaultSingleJarCommandLineWithoutOneVersion(
             output,
diff --git a/src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionWhitelist.java b/src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionAllowlist.java
similarity index 74%
rename from src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionWhitelist.java
rename to src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionAllowlist.java
index f3a7b9a..ee64d4d 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionWhitelist.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/FunctionSplitTransitionAllowlist.java
@@ -17,11 +17,13 @@
 import com.google.devtools.build.lib.cmdline.Label;
 
 /**
- * This class provides constants associated with the function split transition whitelist.
+ * This class provides constants associated with the function split transition allowlist.
  */
-public class FunctionSplitTransitionWhitelist {
-  public static final String WHITELIST_NAME = "function_transition";
-  public static final String WHITELIST_ATTRIBUTE_NAME = "$whitelist_function_transition";
-  public static final Label WHITELIST_LABEL =
+public class FunctionSplitTransitionAllowlist {
+  public static final String NAME = "function_transition";
+  public static final String ATTRIBUTE_NAME = "$whitelist_function_transition";
+  public static final Label LABEL =
       Label.parseAbsoluteUnchecked("//tools/whitelists/function_transition_whitelist");
+
+  private FunctionSplitTransitionAllowlist() {}
 }
diff --git a/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java b/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
index ee08ccb..6f6d581 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
@@ -659,7 +659,7 @@
     private boolean isExecutableStarlark = false;
     private boolean isAnalysisTest = false;
     private boolean hasAnalysisTestTransition = false;
-    private boolean hasFunctionTransitionWhitelist = false;
+    private boolean hasFunctionTransitionAllowlist = false;
     private boolean hasStarlarkRuleTransition = false;
     private boolean ignoreLicenses = false;
     private ImplicitOutputsFunction implicitOutputsFunction = ImplicitOutputsFunction.NONE;
@@ -857,7 +857,7 @@
           isExecutableStarlark,
           isAnalysisTest,
           hasAnalysisTestTransition,
-          hasFunctionTransitionWhitelist,
+          hasFunctionTransitionAllowlist,
           ignoreLicenses,
           implicitOutputsFunction,
           transitionFactory,
@@ -1311,11 +1311,11 @@
     }
 
     /**
-     * This rule class has the _whitelist_function_transition attribute. Intended only for Starlark
+     * This rule class has the _allowlist_function_transition attribute. Intended only for Starlark
      * rules.
      */
-    public <TYPE> Builder setHasFunctionTransitionWhitelist() {
-      this.hasFunctionTransitionWhitelist = true;
+    public <TypeT> Builder setHasFunctionTransitionAllowlist() {
+      this.hasFunctionTransitionAllowlist = true;
       return this;
     }
 
@@ -1526,7 +1526,7 @@
   private final boolean isExecutableStarlark;
   private final boolean isAnalysisTest;
   private final boolean hasAnalysisTestTransition;
-  private final boolean hasFunctionTransitionWhitelist;
+  private final boolean hasFunctionTransitionAllowlist;
   private final boolean ignoreLicenses;
   private final boolean hasAspects;
 
@@ -1661,7 +1661,7 @@
       boolean isExecutableStarlark,
       boolean isAnalysisTest,
       boolean hasAnalysisTestTransition,
-      boolean hasFunctionTransitionWhitelist,
+      boolean hasFunctionTransitionAllowlist,
       boolean ignoreLicenses,
       ImplicitOutputsFunction implicitOutputsFunction,
       TransitionFactory<Rule> transitionFactory,
@@ -1713,7 +1713,7 @@
     this.isExecutableStarlark = isExecutableStarlark;
     this.isAnalysisTest = isAnalysisTest;
     this.hasAnalysisTestTransition = hasAnalysisTestTransition;
-    this.hasFunctionTransitionWhitelist = hasFunctionTransitionWhitelist;
+    this.hasFunctionTransitionAllowlist = hasFunctionTransitionAllowlist;
     this.ignoreLicenses = ignoreLicenses;
     this.configurationFragmentPolicy = configurationFragmentPolicy;
     this.supportsConstraintChecking = supportsConstraintChecking;
@@ -2608,11 +2608,9 @@
     return hasAnalysisTestTransition;
   }
 
-  /**
-   * Returns true if this rule class has the _whitelist_function_transition attribute.
-   */
-  public boolean hasFunctionTransitionWhitelist() {
-    return hasFunctionTransitionWhitelist;
+  /** Returns true if this rule class has the _allowlist_function_transition attribute. */
+  public boolean hasFunctionTransitionAllowlist() {
+    return hasFunctionTransitionAllowlist;
   }
 
   /**
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidConfiguration.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidConfiguration.java
index 4fb08b0..dd16112 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidConfiguration.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidConfiguration.java
@@ -16,8 +16,8 @@
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.RuleContext;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.config.BuildOptions;
 import com.google.devtools.build.lib.analysis.config.ConfigurationFragmentFactory;
 import com.google.devtools.build.lib.analysis.config.CoreOptionConverters.EmptyToNullLabelConverter;
@@ -1143,7 +1143,7 @@
 
   public boolean allowSrcsLessAndroidLibraryDeps(RuleContext ruleContext) {
     return allowAndroidLibraryDepsWithoutSrcs
-        && Whitelist.isAvailable(ruleContext, "allow_deps_without_srcs");
+        && Allowlist.isAvailable(ruleContext, "allow_deps_without_srcs");
   }
 
   @Override
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDataContext.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDataContext.java
index 4e84279..7a88196 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDataContext.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDataContext.java
@@ -18,10 +18,10 @@
 import com.google.devtools.build.lib.actions.ActionAnalysisMetadata;
 import com.google.devtools.build.lib.actions.Artifact;
 import com.google.devtools.build.lib.actions.ArtifactRoot;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.FilesToRunProvider;
 import com.google.devtools.build.lib.analysis.RuleContext;
 import com.google.devtools.build.lib.analysis.TransitionMode;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.actions.ActionConstructionContext;
 import com.google.devtools.build.lib.analysis.actions.SpawnAction;
 import com.google.devtools.build.lib.cmdline.Label;
@@ -93,10 +93,10 @@
   }
 
   private static boolean hasExemption(
-      RuleContext ruleContext, String exemptionName, boolean valueIfNoWhitelist) {
-    return Whitelist.hasWhitelist(ruleContext, exemptionName)
-        ? Whitelist.isAvailable(ruleContext, exemptionName)
-        : valueIfNoWhitelist;
+      RuleContext ruleContext, String exemptionName, boolean valueIfNoAllowlist) {
+    return Allowlist.hasAllowlist(ruleContext, exemptionName)
+        ? Allowlist.isAvailable(ruleContext, exemptionName)
+        : valueIfNoAllowlist;
   }
 
   protected AndroidDataContext(
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDevice.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDevice.java
index 3eefb7f..6724236 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDevice.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDevice.java
@@ -26,6 +26,7 @@
 import com.google.devtools.build.lib.actions.Artifact;
 import com.google.devtools.build.lib.actions.MutableActionGraph.ActionConflictException;
 import com.google.devtools.build.lib.actions.ResourceSet;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.FileProvider;
 import com.google.devtools.build.lib.analysis.FilesToRunProvider;
@@ -37,7 +38,6 @@
 import com.google.devtools.build.lib.analysis.RunfilesSupport;
 import com.google.devtools.build.lib.analysis.TransitionMode;
 import com.google.devtools.build.lib.analysis.TransitiveInfoCollection;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.actions.CustomCommandLine;
 import com.google.devtools.build.lib.analysis.actions.SpawnAction;
 import com.google.devtools.build.lib.analysis.actions.Substitution;
@@ -61,7 +61,7 @@
 
   private static final String DEVICE_BROKER_TYPE = "WRAPPED_EMULATOR";
 
-  static final String WHITELIST_NAME = "android_device";
+  static final String ALLOWLIST_NAME = "android_device";
 
   // Min resolution
   private static final int MIN_HORIZONTAL = 240;
@@ -92,7 +92,7 @@
   public ConfiguredTarget create(RuleContext ruleContext)
       throws InterruptedException, RuleErrorException, ActionConflictException {
     androidSemantics.checkForMigrationTag(ruleContext);
-    checkWhitelist(ruleContext);
+    checkAllowlist(ruleContext);
     Artifact executable = ruleContext.createOutputArtifact();
     Artifact metadata =
         ruleContext.getImplicitOutputArtifact(AndroidRuleClasses.ANDROID_DEVICE_EMULATOR_METADATA);
@@ -156,8 +156,8 @@
         .build();
   }
 
-  private static void checkWhitelist(RuleContext ruleContext) throws RuleErrorException {
-    if (!Whitelist.isAvailable(ruleContext, WHITELIST_NAME)) {
+  private static void checkAllowlist(RuleContext ruleContext) throws RuleErrorException {
+    if (!Allowlist.isAvailable(ruleContext, ALLOWLIST_NAME)) {
       ruleContext.throwWithRuleError("The android_device rule may not be used in this package");
     }
   }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDeviceRule.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDeviceRule.java
index b673879..a5a07c8 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDeviceRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidDeviceRule.java
@@ -19,10 +19,10 @@
 import static com.google.devtools.build.lib.packages.Type.BOOLEAN;
 import static com.google.devtools.build.lib.packages.Type.INTEGER;
 
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.BaseRuleClasses;
 import com.google.devtools.build.lib.analysis.RuleDefinition;
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.config.HostTransition;
 import com.google.devtools.build.lib.packages.RuleClass;
 import com.google.devtools.build.lib.rules.java.JavaSemantics;
@@ -170,7 +170,7 @@
                 .value(true)
                 .nonconfigurable("Called from RunCommand.isExecutable, which takes a Target"))
         .add(
-            Whitelist.getAttributeFromWhitelistName(AndroidDevice.WHITELIST_NAME)
+            Allowlist.getAttributeFromAllowlistName(AndroidDevice.ALLOWLIST_NAME)
                 .value(env.getToolsLabel("//tools/android:android_device_whitelist")))
         .removeAttribute("deps")
         .removeAttribute("data")
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidFeatureFlagSetProvider.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidFeatureFlagSetProvider.java
index 4323d26..9017c4d 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidFeatureFlagSetProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidFeatureFlagSetProvider.java
@@ -66,10 +66,10 @@
 
   /**
    * Constructs a definition for the attribute used to restrict access to feature flags. The
-   * whitelist will only be reached if the feature_flags attribute is explicitly set.
+   * allowlist will only be reached if the feature_flags attribute is explicitly set.
    */
-  public static Attribute.Builder<Label> getWhitelistAttribute(RuleDefinitionEnvironment env) {
-    return ConfigFeatureFlag.getWhitelistAttribute(env, FEATURE_FLAG_ATTR);
+  public static Attribute.Builder<Label> getAllowlistAttribute(RuleDefinitionEnvironment env) {
+    return ConfigFeatureFlag.getAllowlistAttribute(env, FEATURE_FLAG_ATTR);
   }
 
   /**
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBase.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBase.java
index cba24a2..63dd265 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBase.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBase.java
@@ -18,6 +18,7 @@
 import com.google.common.collect.ImmutableList;
 import com.google.devtools.build.lib.actions.Artifact;
 import com.google.devtools.build.lib.actions.MutableActionGraph.ActionConflictException;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.OutputGroupInfo;
 import com.google.devtools.build.lib.analysis.RuleConfiguredTargetBuilder;
@@ -28,7 +29,6 @@
 import com.google.devtools.build.lib.analysis.RunfilesSupport;
 import com.google.devtools.build.lib.analysis.TransitionMode;
 import com.google.devtools.build.lib.analysis.TransitiveInfoCollection;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.actions.Substitution;
 import com.google.devtools.build.lib.analysis.actions.Template;
 import com.google.devtools.build.lib.analysis.actions.TemplateExpansionAction;
@@ -163,8 +163,8 @@
 
     String testClass = getAndCheckTestClass(ruleContext, javaCommon.getSrcsArtifacts());
     getAndCheckTestSupport(ruleContext);
-    if (Whitelist.hasWhitelist(ruleContext, "multiple_proto_rule_types_in_deps_whitelist")
-        && !Whitelist.isAvailable(ruleContext, "multiple_proto_rule_types_in_deps_whitelist")) {
+    if (Allowlist.hasAllowlist(ruleContext, "multiple_proto_rule_types_in_deps_whitelist")
+        && !Allowlist.isAvailable(ruleContext, "multiple_proto_rule_types_in_deps_whitelist")) {
       javaSemantics.checkForProtoLibraryAndJavaProtoLibraryOnSameProto(ruleContext, javaCommon);
     }
     if (ruleContext.hasErrors()) {
@@ -316,7 +316,7 @@
         .setLauncher(launcher)
         .setOneVersionEnforcementLevel(
             doOneVersionEnforcement ? oneVersionEnforcementLevel : OneVersionEnforcementLevel.OFF,
-            javaToolchain.getOneVersionWhitelist())
+            javaToolchain.getOneVersionAllowlist())
         .build();
 
     JavaSourceJarsProvider sourceJarsProvider = javaSourceJarsProviderBuilder.build();
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBaseRule.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBaseRule.java
index 41d5598..c4da347 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBaseRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLocalTestBaseRule.java
@@ -88,7 +88,7 @@
                 .allowedFileTypes()
                 .nonconfigurable("defines an aspect of configuration")
                 .mandatoryProviders(ImmutableList.of(ConfigFeatureFlagProvider.id())))
-        .add(AndroidFeatureFlagSetProvider.getWhitelistAttribute(environment))
+        .add(AndroidFeatureFlagSetProvider.getAllowlistAttribute(environment))
         // TODO(b/38314524): Move $android_resources_busybox and :android_sdk to a separate
         // rule so they're not defined in multiple places
         .add(
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidRuleClasses.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidRuleClasses.java
index 728f4fd..57ed3fb 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidRuleClasses.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidRuleClasses.java
@@ -872,7 +872,7 @@
                   .allowedFileTypes()
                   .nonconfigurable("defines an aspect of configuration")
                   .mandatoryProviders(ImmutableList.of(ConfigFeatureFlagProvider.id())))
-          .add(AndroidFeatureFlagSetProvider.getWhitelistAttribute(env))
+          .add(AndroidFeatureFlagSetProvider.getAllowlistAttribute(env))
           // The resource extractor is used at the binary level to extract java resources from the
           // deploy jar so that they can be added to the APK.
           .add(
diff --git a/src/main/java/com/google/devtools/build/lib/rules/config/ConfigFeatureFlag.java b/src/main/java/com/google/devtools/build/lib/rules/config/ConfigFeatureFlag.java
index 6417a4b..993e337 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/config/ConfigFeatureFlag.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/config/ConfigFeatureFlag.java
@@ -26,13 +26,13 @@
 import com.google.common.collect.Multiset;
 import com.google.devtools.build.lib.actions.Artifact;
 import com.google.devtools.build.lib.actions.MutableActionGraph.ActionConflictException;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.RuleConfiguredTargetBuilder;
 import com.google.devtools.build.lib.analysis.RuleConfiguredTargetFactory;
 import com.google.devtools.build.lib.analysis.RuleContext;
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
 import com.google.devtools.build.lib.analysis.RunfilesProvider;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.collect.nestedset.NestedSetBuilder;
 import com.google.devtools.build.lib.packages.Attribute;
@@ -47,27 +47,27 @@
  */
 public class ConfigFeatureFlag implements RuleConfiguredTargetFactory {
   /** The name of the policy that is used to restrict access to the config_feature_flag rule. */
-  private static final String WHITELIST_NAME = "config_feature_flag";
+  private static final String ALLOWLIST_NAME = "config_feature_flag";
 
   /** The label of the policy that is used to restrict access to the config_feature_flag rule. */
-  private static final String WHITELIST_LABEL =
+  private static final String ALLOWLIST_LABEL =
       "//tools/whitelists/config_feature_flag:config_feature_flag";
 
   /** Constructs a definition for the attribute used to restrict access to config_feature_flag. */
-  public static Attribute.Builder<Label> getWhitelistAttribute(RuleDefinitionEnvironment env) {
-    return Whitelist.getAttributeFromWhitelistName(WHITELIST_NAME)
-        .value(env.getToolsLabel(WHITELIST_LABEL));
+  public static Attribute.Builder<Label> getAllowlistAttribute(RuleDefinitionEnvironment env) {
+    return Allowlist.getAttributeFromAllowlistName(ALLOWLIST_NAME)
+        .value(env.getToolsLabel(ALLOWLIST_LABEL));
   }
 
   /**
    * Constructs a definition for the attribute used to restrict access to config_feature_flag. The
-   * whitelist will only be reached if the given {@code attributeToInspect} has a value explicitly
+   * allowlist will only be reached if the given {@code attributeToInspect} has a value explicitly
    * specified. It must be non-configurable.
    */
-  public static Attribute.Builder<Label> getWhitelistAttribute(
+  public static Attribute.Builder<Label> getAllowlistAttribute(
       RuleDefinitionEnvironment env, String attributeToInspect) {
-    final Label label = env.getToolsLabel(WHITELIST_LABEL);
-    return Whitelist.getAttributeFromWhitelistName(WHITELIST_NAME)
+    final Label label = env.getToolsLabel(ALLOWLIST_LABEL);
+    return Allowlist.getAttributeFromAllowlistName(ALLOWLIST_NAME)
         .value(
             new ComputedDefault() {
               @Override
@@ -81,10 +81,10 @@
    * Returns whether config_feature_flag and related features are available to the current rule.
    *
    * <p>The current rule must have an attribute defined on it created with {@link
-   * #getWhitelistAttribute}.
+   * #getAllowlistAttribute}.
    */
   public static boolean isAvailable(RuleContext ruleContext) {
-    return Whitelist.isAvailable(ruleContext, WHITELIST_NAME);
+    return Allowlist.isAvailable(ruleContext, ALLOWLIST_NAME);
   }
 
   @Override
diff --git a/src/main/java/com/google/devtools/build/lib/rules/config/ConfigRuleClasses.java b/src/main/java/com/google/devtools/build/lib/rules/config/ConfigRuleClasses.java
index c1199ed..029cc16 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/config/ConfigRuleClasses.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/config/ConfigRuleClasses.java
@@ -395,7 +395,7 @@
     @Override
     public RuleClass build(RuleClass.Builder builder, RuleDefinitionEnvironment env) {
       return builder
-          .setUndocumented(/* the feature flag feature has not yet been launched */)
+          .setUndocumented(/* the feature flag feature has not yet been launched */ )
           .requiresConfigurationFragments(ConfigFeatureFlagConfiguration.class)
           .add(
               attr("allowed_values", STRING_LIST)
@@ -403,10 +403,8 @@
                   .nonEmpty()
                   .orderIndependent()
                   .nonconfigurable(NONCONFIGURABLE_ATTRIBUTE_REASON))
-          .add(
-              attr("default_value", STRING)
-                  .nonconfigurable(NONCONFIGURABLE_ATTRIBUTE_REASON))
-          .add(ConfigFeatureFlag.getWhitelistAttribute(env))
+          .add(attr("default_value", STRING).nonconfigurable(NONCONFIGURABLE_ATTRIBUTE_REASON))
+          .add(ConfigFeatureFlag.getAllowlistAttribute(env))
           .removeAttribute(BaseRuleClasses.TAGGED_TRIMMING_ATTR)
           .build();
     }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchain.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchain.java
index aa5e144..5e83c92 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchain.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchain.java
@@ -43,11 +43,11 @@
   /** Default attribute name for the c++ toolchain type */
   public static final String CC_TOOLCHAIN_TYPE_ATTRIBUTE_NAME = "$cc_toolchain_type";
 
-  public static final String ALLOWED_LAYERING_CHECK_FEATURES_WHITELIST =
+  public static final String ALLOWED_LAYERING_CHECK_FEATURES_ALLOWLIST =
       "disabling_parse_headers_and_layering_check_allowed";
   public static final String ALLOWED_LAYERING_CHECK_FEATURES_TARGET =
       "@bazel_tools//tools/build_defs/cc/whitelists/parse_headers_and_layering_check:"
-          + ALLOWED_LAYERING_CHECK_FEATURES_WHITELIST;
+          + ALLOWED_LAYERING_CHECK_FEATURES_ALLOWLIST;
   public static final Label ALLOWED_LAYERING_CHECK_FEATURES_LABEL =
       Label.parseAbsoluteUnchecked(ALLOWED_LAYERING_CHECK_FEATURES_TARGET);
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainAttributesProvider.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainAttributesProvider.java
index b40713a..f7000c6 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainAttributesProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainAttributesProvider.java
@@ -21,6 +21,7 @@
 import com.google.common.collect.ImmutableMap;
 import com.google.devtools.build.lib.actions.Actions;
 import com.google.devtools.build.lib.actions.Artifact;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.FileProvider;
 import com.google.devtools.build.lib.analysis.LicensesProvider;
 import com.google.devtools.build.lib.analysis.LicensesProvider.TargetLicense;
@@ -30,7 +31,6 @@
 import com.google.devtools.build.lib.analysis.RuleContext;
 import com.google.devtools.build.lib.analysis.TransitionMode;
 import com.google.devtools.build.lib.analysis.TransitiveInfoCollection;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.platform.ToolchainInfo;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.collect.nestedset.NestedSet;
@@ -99,7 +99,7 @@
   private final Label ccToolchainLabel;
   private final TransitiveInfoCollection staticRuntimeLib;
   private final TransitiveInfoCollection dynamicRuntimeLib;
-  private final PackageSpecificationProvider whitelistForLayeringCheck;
+  private final PackageSpecificationProvider allowlistForLayeringCheck;
 
   public CcToolchainAttributesProvider(
       RuleContext ruleContext,
@@ -233,9 +233,9 @@
       this.toolchainType = null;
     }
     this.additionalBuildVariablesComputer = additionalBuildVariablesComputer;
-    this.whitelistForLayeringCheck =
-        Whitelist.fetchPackageSpecificationProvider(
-            ruleContext, CcToolchain.ALLOWED_LAYERING_CHECK_FEATURES_WHITELIST);
+    this.allowlistForLayeringCheck =
+        Allowlist.fetchPackageSpecificationProvider(
+            ruleContext, CcToolchain.ALLOWED_LAYERING_CHECK_FEATURES_ALLOWLIST);
   }
 
   public String getCpu() {
@@ -423,8 +423,8 @@
     return ifsoBuilder;
   }
 
-  public PackageSpecificationProvider getWhitelistForLayeringCheck() {
-    return whitelistForLayeringCheck;
+  public PackageSpecificationProvider getAllowlistForLayeringCheck() {
+    return allowlistForLayeringCheck;
   }
 
   private static NestedSet<Artifact> getMiddlemanOrFiles(RuleContext context, String attribute) {
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProvider.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProvider.java
index dc09d58..40c4e14 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProvider.java
@@ -103,7 +103,7 @@
           /* targetSystemName= */ "",
           /* additionalMakeVariables= */ ImmutableMap.of(),
           /* legacyCcFlagsMakeVariable= */ "",
-          /* whitelistForLayeringCheck= */ null);
+          /* allowlistForLayeringCheck= */ null);
 
   @Nullable private final CppConfiguration cppConfiguration;
   private final PathFragment crosstoolTopPathFragment;
@@ -165,7 +165,7 @@
   private final FdoContext fdoContext;
 
   private final LicensesProvider licensesProvider;
-  private final PackageSpecificationProvider whitelistForLayeringCheck;
+  private final PackageSpecificationProvider allowlistForLayeringCheck;
 
   public CcToolchainProvider(
       ImmutableMap<String, Object> values,
@@ -221,7 +221,7 @@
       String targetSystemName,
       ImmutableMap<String, String> additionalMakeVariables,
       String legacyCcFlagsMakeVariable,
-      PackageSpecificationProvider whitelistForLayeringCheck) {
+      PackageSpecificationProvider allowlistForLayeringCheck) {
     super(values, Location.BUILTIN);
     this.cppConfiguration = cppConfiguration;
     this.crosstoolTopPathFragment = crosstoolTopPathFragment;
@@ -278,7 +278,7 @@
     this.targetSystemName = targetSystemName;
     this.additionalMakeVariables = additionalMakeVariables;
     this.legacyCcFlagsMakeVariable = legacyCcFlagsMakeVariable;
-    this.whitelistForLayeringCheck = whitelistForLayeringCheck;
+    this.allowlistForLayeringCheck = allowlistForLayeringCheck;
   }
 
   /**
@@ -910,8 +910,8 @@
     return dynamicRuntimeLinkInputs;
   }
 
-  public PackageSpecificationProvider getWhitelistForLayeringCheck() {
-    return whitelistForLayeringCheck;
+  public PackageSpecificationProvider getAllowlistForLayeringCheck() {
+    return allowlistForLayeringCheck;
   }
 }
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProviderHelper.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProviderHelper.java
index cd6df06..4f4a698 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProviderHelper.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainProviderHelper.java
@@ -184,8 +184,8 @@
     ImmutableList<PathFragment> builtInIncludeDirectories =
         builtInIncludeDirectoriesBuilder.build();
 
-    PackageSpecificationProvider whitelistForLayeringCheck =
-        attributes.getWhitelistForLayeringCheck();
+    PackageSpecificationProvider allowlistForLayeringCheck =
+        attributes.getAllowlistForLayeringCheck();
 
     return new CcToolchainProvider(
         getToolchainForStarlark(toolPaths),
@@ -249,7 +249,7 @@
         toolchainConfigInfo.getTargetSystemName(),
         computeAdditionalMakeVariables(toolchainConfigInfo),
         computeLegacyCcFlagsMakeVariable(toolchainConfigInfo),
-        whitelistForLayeringCheck);
+        allowlistForLayeringCheck);
   }
 
   @Nullable
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
index 4839253..fcc0ae3 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcToolchainRule.java
@@ -21,12 +21,12 @@
 import static com.google.devtools.build.lib.packages.Type.STRING;
 
 import com.google.common.collect.ImmutableList;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.BaseRuleClasses;
 import com.google.devtools.build.lib.analysis.PlatformConfiguration;
 import com.google.devtools.build.lib.analysis.RuleDefinition;
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
 import com.google.devtools.build.lib.analysis.TemplateVariableInfo;
-import com.google.devtools.build.lib.analysis.Whitelist;
 import com.google.devtools.build.lib.analysis.config.HostTransition;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.packages.Attribute.LabelLateBoundDefault;
@@ -357,8 +357,8 @@
                 .mandatoryProviders(CcToolchainConfigInfo.PROVIDER.id())
                 .mandatory())
         .add(
-            Whitelist.getAttributeFromWhitelistName(
-                    CcToolchain.ALLOWED_LAYERING_CHECK_FEATURES_WHITELIST)
+            Allowlist.getAttributeFromAllowlistName(
+                    CcToolchain.ALLOWED_LAYERING_CHECK_FEATURES_ALLOWLIST)
                 .value(CcToolchain.ALLOWED_LAYERING_CHECK_FEATURES_LABEL))
         .build();
   }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
index 25b84a5..22771a9 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
@@ -68,7 +68,7 @@
   @Nullable private Function<Artifact, Artifact> derivedJars = null;
   private boolean checkDesugarDeps;
   private OneVersionEnforcementLevel oneVersionEnforcementLevel = OneVersionEnforcementLevel.OFF;
-  @Nullable private Artifact oneVersionWhitelistArtifact;
+  @Nullable private Artifact oneVersionAllowlistArtifact;
   @Nullable private Artifact sharedArchive;
 
   /** Type of compression to apply to output archive. */
@@ -164,9 +164,9 @@
   /** Whether or not singlejar would attempt to enforce one version of java classes in the jar */
   public DeployArchiveBuilder setOneVersionEnforcementLevel(
       OneVersionEnforcementLevel oneVersionEnforcementLevel,
-      @Nullable Artifact oneVersionWhitelistArtifact) {
+      @Nullable Artifact oneVersionAllowlistArtifact) {
     this.oneVersionEnforcementLevel = oneVersionEnforcementLevel;
-    this.oneVersionWhitelistArtifact = oneVersionWhitelistArtifact;
+    this.oneVersionAllowlistArtifact = oneVersionAllowlistArtifact;
     return this;
   }
 
@@ -213,7 +213,7 @@
       Artifact launcher,
       boolean usingNativeSinglejar,
       OneVersionEnforcementLevel oneVersionEnforcementLevel,
-      @Nullable Artifact oneVersionWhitelistArtifact) {
+      @Nullable Artifact oneVersionAllowlistArtifact) {
 
     CustomCommandLine.Builder args = CustomCommandLine.builder();
     args.addExecPath("--output", outputJar);
@@ -255,8 +255,8 @@
       args.add("--enforce_one_version");
       // RuleErrors should have been added in Builder.build() before this command
       // line is invoked.
-      Preconditions.checkNotNull(oneVersionWhitelistArtifact);
-      args.addExecPath("--one_version_whitelist", oneVersionWhitelistArtifact);
+      Preconditions.checkNotNull(oneVersionAllowlistArtifact);
+      args.addExecPath("--one_version_whitelist", oneVersionAllowlistArtifact);
       if (oneVersionEnforcementLevel == OneVersionEnforcementLevel.WARNING) {
         args.add("--succeed_on_found_violations");
       }
@@ -333,12 +333,12 @@
     }
 
     if (oneVersionEnforcementLevel != OneVersionEnforcementLevel.OFF) {
-      if (oneVersionWhitelistArtifact == null) {
+      if (oneVersionAllowlistArtifact == null) {
         OneVersionCheckActionBuilder.addRuleErrorForMissingArtifacts(
             ruleContext, JavaToolchainProvider.from(ruleContext));
         return;
       }
-      inputs.add(oneVersionWhitelistArtifact);
+      inputs.add(oneVersionAllowlistArtifact);
     }
     if (sharedArchive != null) {
       inputs.add(sharedArchive);
@@ -364,7 +364,7 @@
             launcher,
             usingNativeSinglejar,
             oneVersionEnforcementLevel,
-            oneVersionWhitelistArtifact,
+            oneVersionAllowlistArtifact,
             sharedArchive);
     if (checkDesugarDeps) {
       commandLine = CommandLine.concat(commandLine, ImmutableList.of("--check_desugar_deps"));
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaBinary.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaBinary.java
index 6b3a46f..248d2b7 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaBinary.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaBinary.java
@@ -391,7 +391,7 @@
         .setLauncher(launcher)
         .setOneVersionEnforcementLevel(
             javaConfig.oneVersionEnforcementLevel(),
-            JavaToolchainProvider.from(ruleContext).getOneVersionWhitelist())
+            JavaToolchainProvider.from(ruleContext).getOneVersionAllowlist())
         .setSharedArchive(jsa)
         .build();
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaSemantics.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaSemantics.java
index 26e52b0..27e4774 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaSemantics.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaSemantics.java
@@ -264,7 +264,7 @@
       Artifact launcher,
       boolean usingNativeSinglejar,
       OneVersionEnforcementLevel oneVersionEnforcementLevel,
-      Artifact oneVersionWhitelistArtifact,
+      Artifact oneVersionAllowlistArtifact,
       Artifact sharedArchive);
 
   /**
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchain.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchain.java
index ed26596..d72b441 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchain.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchain.java
@@ -88,7 +88,7 @@
         ruleContext.attributes().get("forcibly_disable_header_compilation", Type.BOOLEAN);
     Artifact singleJar = ruleContext.getPrerequisiteArtifact("singlejar", TransitionMode.HOST);
     Artifact oneVersion = ruleContext.getPrerequisiteArtifact("oneversion", TransitionMode.HOST);
-    Artifact oneVersionWhitelist =
+    Artifact oneVersionAllowlist =
         ruleContext.getPrerequisiteArtifact("oneversion_whitelist", TransitionMode.HOST);
     Artifact genClass = ruleContext.getPrerequisiteArtifact("genclass", TransitionMode.HOST);
     Artifact resourceJarBuilder =
@@ -157,7 +157,7 @@
             forciblyDisableHeaderCompilation,
             singleJar,
             oneVersion,
-            oneVersionWhitelist,
+            oneVersionAllowlist,
             genClass,
             resourceJarBuilder,
             timezoneData,
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainProvider.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainProvider.java
index 714d060..2c2b3fb 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainProvider.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaToolchainProvider.java
@@ -91,7 +91,7 @@
       boolean forciblyDisableHeaderCompilation,
       Artifact singleJar,
       @Nullable Artifact oneVersion,
-      @Nullable Artifact oneVersionWhitelist,
+      @Nullable Artifact oneVersionAllowlist,
       Artifact genClass,
       @Nullable Artifact resourceJarBuilder,
       @Nullable Artifact timezoneData,
@@ -115,7 +115,7 @@
         forciblyDisableHeaderCompilation,
         singleJar,
         oneVersion,
-        oneVersionWhitelist,
+        oneVersionAllowlist,
         genClass,
         resourceJarBuilder,
         timezoneData,
@@ -145,7 +145,7 @@
   private final boolean forciblyDisableHeaderCompilation;
   private final Artifact singleJar;
   @Nullable private final Artifact oneVersion;
-  @Nullable private final Artifact oneVersionWhitelist;
+  @Nullable private final Artifact oneVersionAllowlist;
   private final Artifact genClass;
   @Nullable private final Artifact resourceJarBuilder;
   @Nullable private final Artifact timezoneData;
@@ -176,7 +176,7 @@
       boolean forciblyDisableHeaderCompilation,
       Artifact singleJar,
       @Nullable Artifact oneVersion,
-      @Nullable Artifact oneVersionWhitelist,
+      @Nullable Artifact oneVersionAllowlist,
       Artifact genClass,
       @Nullable Artifact resourceJarBuilder,
       @Nullable Artifact timezoneData,
@@ -206,7 +206,7 @@
     this.forciblyDisableHeaderCompilation = forciblyDisableHeaderCompilation;
     this.singleJar = singleJar;
     this.oneVersion = oneVersion;
-    this.oneVersionWhitelist = oneVersionWhitelist;
+    this.oneVersionAllowlist = oneVersionAllowlist;
     this.genClass = genClass;
     this.resourceJarBuilder = resourceJarBuilder;
     this.timezoneData = timezoneData;
@@ -302,10 +302,16 @@
     return oneVersion;
   }
 
-  /** Return the {@link Artifact} of the whitelist used by the one-version compliance checker. */
+  /** Return the {@link Artifact} of the allowlist used by the one-version compliance checker. */
+  @Nullable
+  public Artifact getOneVersionAllowlist() {
+    return oneVersionAllowlist;
+  }
+
+  /** Return the {@link Artifact} of the allowlist used by the one-version compliance checker. */
   @Nullable
   public Artifact getOneVersionWhitelist() {
-    return oneVersionWhitelist;
+    return oneVersionAllowlist;
   }
 
   /** Returns the {@link Artifact} of the GenClass deploy jar */
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/OneVersionCheckActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/java/OneVersionCheckActionBuilder.java
index 665a915..5423cd0 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/OneVersionCheckActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/OneVersionCheckActionBuilder.java
@@ -76,8 +76,8 @@
     Preconditions.checkNotNull(jarsToCheck);
 
     Artifact oneVersionTool = javaToolchain.getOneVersionBinary();
-    Artifact oneVersionWhitelist = javaToolchain.getOneVersionWhitelist();
-    if (oneVersionTool == null || oneVersionWhitelist == null) {
+    Artifact oneVersionAllowlist = javaToolchain.getOneVersionAllowlist();
+    if (oneVersionTool == null || oneVersionAllowlist == null) {
       addRuleErrorForMissingArtifacts(ruleContext, javaToolchain);
       return outputArtifact;
     }
@@ -85,7 +85,7 @@
     CustomCommandLine.Builder oneVersionArgsBuilder =
         CustomCommandLine.builder()
             .addExecPath("--output", outputArtifact)
-            .addExecPath("--whitelist", oneVersionWhitelist);
+            .addExecPath("--whitelist", oneVersionAllowlist);
     if (enforcementLevel == OneVersionEnforcementLevel.WARNING) {
       oneVersionArgsBuilder.add("--succeed_on_found_violations");
     }
@@ -94,7 +94,7 @@
     ruleContext.registerAction(
         new SpawnAction.Builder()
             .addOutput(outputArtifact)
-            .addInput(oneVersionWhitelist)
+            .addInput(oneVersionAllowlist)
             .addTransitiveInputs(jarsToCheck)
             .setExecutable(oneVersionTool)
             .addCommandLine(
@@ -112,7 +112,7 @@
         String.format(
             "one version enforcement was requested but it is not supported by the current "
                 + "Java toolchain '%s'; see the "
-                + "java_toolchain.oneversion and java_toolchain.oneversion_whitelist "
+                + "java_toolchain.oneversion and java_toolchain.oneversion_allowlist "
                 + "attributes",
             javaToolchain.getToolchainLabel()));
   }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/ProguardLibrary.java b/src/main/java/com/google/devtools/build/lib/rules/java/ProguardLibrary.java
index a965fdb..39fbebe 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/ProguardLibrary.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/ProguardLibrary.java
@@ -71,11 +71,11 @@
 
     Collection<Artifact> localSpecs = collectLocalProguardSpecs();
     if (!localSpecs.isEmpty()) {
-      // Pass our local proguard configs through the validator, which checks a whitelist.
-      FilesToRunProvider proguardWhitelister =
+      // Pass our local proguard configs through the validator, which checks an allowlist.
+      FilesToRunProvider proguardAllowlister =
           ruleContext.getExecutablePrerequisite("$proguard_whitelister", TransitionMode.HOST);
       for (Artifact specToValidate : localSpecs) {
-        specsBuilder.add(validateProguardSpec(proguardWhitelister, specToValidate));
+        specsBuilder.add(validateProguardSpec(proguardAllowlister, specToValidate));
       }
     }
 
@@ -108,11 +108,11 @@
   }
 
   /**
-   * Creates an action to run the Proguard whitelister over the given Proguard spec and returns the
+   * Creates an action to run the Proguard allowlister over the given Proguard spec and returns the
    * validated Proguard spec, ready to be exported.
    */
   private Artifact validateProguardSpec(
-      FilesToRunProvider proguardWhitelister, Artifact specToValidate) {
+      FilesToRunProvider proguardAllowlister, Artifact specToValidate) {
     // If we're validating j/a/b/testapp/proguard.cfg, the output will be:
     // j/a/b/testapp/proguard.cfg_valid
     Artifact output =
@@ -126,7 +126,7 @@
         new SpawnAction.Builder()
             .addInput(specToValidate)
             .addOutput(output)
-            .setExecutable(proguardWhitelister)
+            .setExecutable(proguardAllowlister)
             .setProgressMessage("Validating proguard configuration")
             .setMnemonic("ValidateProguard")
             .addCommandLine(
diff --git a/src/main/java/com/google/devtools/build/lib/runtime/CommandEnvironment.java b/src/main/java/com/google/devtools/build/lib/runtime/CommandEnvironment.java
index 19cbb07..a706129 100644
--- a/src/main/java/com/google/devtools/build/lib/runtime/CommandEnvironment.java
+++ b/src/main/java/com/google/devtools/build/lib/runtime/CommandEnvironment.java
@@ -216,7 +216,7 @@
 
     this.repoEnv.putAll(clientEnv);
     if (command.builds()) {
-      // Compute the set of environment variables that are whitelisted on the commandline
+      // Compute the set of environment variables that are allowlisted on the commandline
       // for inheritance.
       for (Map.Entry<String, String> entry :
           options.getOptions(CoreOptions.class).actionEnvironment) {
@@ -358,18 +358,18 @@
   }
 
   /**
-   * Return an ordered version of the client environment restricted to those variables whitelisted
+   * Return an ordered version of the client environment restricted to those variables allowlisted
    * by the command-line options to be inheritable by actions.
    */
-  public Map<String, String> getWhitelistedActionEnv() {
+  public Map<String, String> getAllowlistedActionEnv() {
     return filterClientEnv(visibleActionEnv);
   }
 
   /**
-   * Return an ordered version of the client environment restricted to those variables whitelisted
+   * Return an ordered version of the client environment restricted to those variables allowlisted
    * by the command-line options to be inheritable by actions.
    */
-  public Map<String, String> getWhitelistedTestEnv() {
+  public Map<String, String> getAllowlistedTestEnv() {
     return filterClientEnv(visibleTestEnv);
   }
 
diff --git a/src/main/java/com/google/devtools/build/lib/runtime/commands/info/ClientEnv.java b/src/main/java/com/google/devtools/build/lib/runtime/commands/info/ClientEnv.java
index 11eac4c..2a0534d 100644
--- a/src/main/java/com/google/devtools/build/lib/runtime/commands/info/ClientEnv.java
+++ b/src/main/java/com/google/devtools/build/lib/runtime/commands/info/ClientEnv.java
@@ -33,12 +33,12 @@
   @Override
   public byte[] get(Supplier<BuildConfiguration> configurationSupplier, CommandEnvironment env) {
     String result = "";
-    for (Map.Entry<String, String> entry : env.getWhitelistedActionEnv().entrySet()) {
+    for (Map.Entry<String, String> entry : env.getAllowlistedActionEnv().entrySet()) {
       // TODO(bazel-team): as the syntax of our rc-files does not support to express new-lines in
       // values, we produce syntax errors if the value of the entry contains a newline character.
       result += "build --action_env=" + entry.getKey() + "=" + entry.getValue() + "\n";
     }
-    for (Map.Entry<String, String> entry : env.getWhitelistedTestEnv().entrySet()) {
+    for (Map.Entry<String, String> entry : env.getAllowlistedTestEnv().entrySet()) {
       // TODO(bazel-team): as the syntax of our rc-files does not support to express new-lines in
       // values, we produce syntax errors if the value of the entry contains a newline character.
       result += "build --test_env=" + entry.getKey() + "=" + entry.getValue() + "\n";