Decide what you want to protect.
Blocking access to one service says little about the information people can use in another. Begin with sensitive data categories and the workflows where they appear.
Use the smallest useful rule.
A warning can prompt a review. A block can stop a supported action. Log mode can help you observe usage, but it does not prevent a submission. Choose the action deliberately.
Revisit the workflow.
Tools and working habits change. A policy should have an owner who reviews its coverage and exceptions as the team adopts new ways of using AI.