How can I undo "always allow" in keychain item

You should be able to clear out any white listed programs and then reset the default behavior from Keychain Access.

• First select Fantastical (or any apps that are cleared) and then press the -
• Second, choose Confirm and Ask as needed.
• Third, select Attributes and make sure the changes are saved (you should probably have to authenticate as well at this step)
• Go back to Access Control to verify the settings have been saved properly

If this doesn't work, you might need to repair that keychain containing that item, also using Keychain Access menu to open the Keychain First Aid tool.