Company-approved sandbox tools that do not retain or train on your data are the appropriate option for confidential tasks. The Allowed / Restricted / Prohibited framework applies to public external tools. Your organization’s internal guidelines will specify which tools are approved and for what use cases.