#!/usr/bin/perl

use strict;
use warnings;
use Data::Dumper;

$_ = 'allow:test1,"@test 2 " deny:test3,test4 password:"123   456"';

my %hash = /(\w+):(.+?)(?:\s+(?=\w+:)|$)/g;

foreach (keys %hash) {
  $hash{$_} = [ split /,/, $hash{$_} ] if $hash{$_} =~ /,/;
}

print Dumper \%hash;