Just for contrast:
We are not allowed to install software on our PCs and that is enforced (we can be dismissed for plugging in a personal usb drive). There are regular scans of our PCs to ensure that no new ports have been opened and no extra software shows up.
This is on our low-security computers that we use to do web browsing and email.
The ones we use to develop on can't get to the net and adding anything to our stack requires filing paperwork, a committee meeting and a security review before we can try it out in dev. More forms if it becomes part of our production stack.
Yet still attackers (that we hired to test our security) were able to get on the first network and jump to the air-gap to the second, so we are continuing to improve our processes.
We are a pretty high-value target though.
I guess what you can do on your work computer has to relate to how important it is to your company to keep their network secure. I wouldn't want to be the one that accidentally installed the root kit that let attackers at all their customers credit cards, especially after the company made it clear that we weren't supposed to install anything.