Philosophy: How far back does "Attribution" go ?

Or is it completely prohibited that an employee to use open source while "on the clock"?

I work for "cisco Systems"; a large provider of (among other things) proprietary closed-source software. Any actual use of open source code in a product requires review and permission of a committee of lawyers/etc. For some licenses that we have had prior experience with, the decision path is easier. BSD will generally be OK. GPL3 will generally be rejected. Given the intentionally viral nature of some licenses, we want to be very careful not to accidentally contaminate the pieces of SW that we want to keep proprietary.

We haven't (yet) has issues with "looking" at open source software, but I have dealt with compiler vendors where the compiler developer was not permitted to get anywhere near gcc sources; any ambiguity or compatibility issue that required "just WTF is gcc DOING here" sorts of knowledge would require an extra non-compiler-developer to go look at gcc and report the causes in a legally "cleanroom" way.

There aren't yet any restrictions on merely using open source tools. We've been using gcc for 20+ years, for instance. Though we have done the 'pure' library thing in various forms.

I can't help but think that the original open-source evangelists had something else in mind, than supporting a large cadre of lawyers. (well, "no proprietary SW at all", I guess. No comment.)