#!/usr/bin/perl

use strict;
use warnings;
use Text::ParseWords;
use Data::Dumper;

$_ = 'allow:test1,"@test 2 " deny:test3,test4 password:"123   456"';

my %hash = /(\w+):(.+?)(?:\s+(?=\w+:)|$)/g;

foreach (keys %hash) {
  my @arr = parse_line(',', 1, $hash{$_});

  $hash{$_} = \@arr if @arr > 1;
}

print Dumper \%hash;