Yup: https://guide.meteor.com/security.html#allow-deny

I just submitted a PR to the main Meteor docs pointing there: https://github.com/meteor/docs/pull/164