How are you using AI at work without stepping on company policy?

Our team is still figuring out what’s okay to paste into an assistant. What rules have other teams landed on — approved tools only? No customer data? Nothing at all?