Aha! You're absolutely right. I'd forgotten Text::ParseWords. In which case, replace my solution with this:

#!/usr/bin/perl

use strict;
use warnings;
use Text::ParseWords;
use Data::Dumper;

$_ = 'allow:test1,"@test 2 " deny:test3,test4 password:"123   456"';

my %hash = /(\w+):(.+?)(?:\s+(?=\w+:)|$)/g;

foreach (keys %hash) {
  my @arr = parse_line(',', 1, $hash{$_});

  $hash{$_} = \@arr if @arr > 1;
}

print Dumper \%hash;
[download]

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg

This still breaks with an input string like

$_ = 'allow:test1,"@test 2 " deny:test3,test4 password:"123   456", "h
+ey, Doh:bad "';
[download]

JJ