Start with format requirements. Specify allowed characters (letters, numbers, underscores?), length limits (3-20 characters is common), and any prohibited patterns (no spaces, no special characters, cannot start with a number). These are the technical constraints.
List prohibited categories with examples. System terms, brand names, impersonation attempts, and offensive content should all be explicitly mentioned. Give examples so users understand the scope. "Usernames may not include trademarked brand names such as Google, Nike, or Apple."
Explain the verification process for restricted terms. If someone can claim a brand name with documentation, say so. "Business accounts may request verification of trademarked usernames by submitting trademark documentation to..."
Define consequences and appeals. What happens if someone violates the policy? Username change? Account suspension? How can they appeal? "Accounts with policy-violating usernames will be required to select a new username within 7 days. Appeals may be submitted to..."