For each combinator there is a table that acts as "global" environment for it's code, so accessible is only what is explicitly added to it. Actually, there is more than one table, to keep global things separate from combinator-local "global" variables, but even standard lua library have to be made available by adding corresponding functions to environment (even pairs() ).
I tried to make most important of standard lua library available, but if anybody found something is lost - please report this, and it will be added. I'm sure that a lot is missed, so I plan to check this with lua docs soon.
Currently there are four special variables: delay, rednet, greennet, output, and they are the only way to interact with game. There is global 'print' also, which maps to 'game.print', but it may be changed soon because I'm not sure that everybody should be able to spam everyone's chat.
I am agree that some game variables may be useful while being safe (like game.tick), so I'll start adding them when figure out which ones and at what name should be available, and without any additional significant overhead. It is not possible to make it as blacklist, because many api objects has references to other game objects, for example access to current combinator entity is removed because it, at least, includes reference to surface object, which could be used then to manipulate entire surface freely.
