Module 3 of 4
Data boundaries
Separate permitted, sensitive, and restricted inputs.
Sort what you might paste into three buckets: freely usable, sensitive but permitted with care, and never. Customer personal data, unreleased financials, anything covered by a confidentiality agreement, and colleagues' personal information belong in the third bucket by default. So does anything you would not want appearing in an unrelated conversation later.
Write the rule as something a busy person can follow in the moment — a short list on one page, not a policy document. And name the alternative: if the answer is "do not paste the customer list", say what to do instead. A rule with no workable alternative gets ignored within a fortnight.
Three buckets, one page, and always name the alternative. A rule with no workable alternative gets ignored.