Is application whitelisting viable?

Particularly for those in management; can application whitelisting work in a software engineering company? Every package, every module, every new version of every boost lib… I can’t see how whitelisting can be implemented at a company without crippling engineering. I could live with a whitelist of PPAs but cannot see how devs can operate by submitting a request form every time they want to import a new module. I’m keen to hear opinions, success stories, and disasters that people have come across.