Thanks for your response. By "whitelist" I was talking about putting permissions into a whitelist mode where everything starts out blocked-- something I thought would have been the default? I wasn't talking about the server command /whitelist to allow users to connect. Sorry for the confusion.
works for some of the permissions, but apparently doesn't apply to plugins, so it looks like I'll need to wildcard each plugin I load too?
Are there any other core permissions that won't cover? minecraft.*? bukkit.*?