If the list is a hash, you could tie that hash to your your package and give the caller the tied handle. That way, they can manipulate the hash with all the familiar hash operators (keys, values, each etc. and the standard method of resetting these iterators), but you get to intervene in every operation and vet what they do.

Using ties this way makes for a nice perlish and familar standard interface to class attributes, including using them as lvalues, without relinguishing control. Ties aren't the fastest things in the world, but they're no slower than calling setters and getters.