How much IP risk is acceptable? - What data classifications can be shared with external tools? - What compliance obligations are non-negotiable? - What is the cost of restricting AI tool access versus the cost of potential incidents?