What a policy must answer
State approved tools and permitted data.
Define review and external-action authority.
A policy that says only 'use AI responsibly' gives little operational help. Locate the approval list and rules relevant to your task.
Name the reporting route and policy owner.