Define the data and business behavior the policy is supposed to protect.
Start in an audit/test mode where the platform supports it. Review matches with the data owners and security team.
Measure false positives and identify legitimate workflows that need a safer approved path.
Then introduce user warnings, justification, encryption or blocking according to risk.
Keep exceptions narrow, owned and periodically reviewed.