Aha! You're absolutely right. I'd forgotten Text::ParseWords. In which case, replace my solution with this:

#!/usr/bin/perl

use strict;
use warnings;
use Text::ParseWords;
use Data::Dumper;

$_ = 'allow:test1,"@test 2 " deny:test3,test4 password:"123   456"';

my %hash = /(\w+):(.+?)(?:\s+(?=\w+:)|$)/g;

foreach (keys %hash) {
  my @arr = parse_line(',', 1, $hash{$_});

  $hash{$_} = \@arr if @arr > 1;
}

print Dumper \%hash;
[download]

--
<http://www.dave.org.uk>

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg