I deal with a lot of nerds, but starting in about 2008 we all segmented up the 10.x space and each of us has a /16, with each site we manage having typically a /24 or /22, so nobody overlaps. We can light up tunnels between each other and never have a collision. We have a little internal registry on a private wiki, and it's been serving us well for... oh dear, almost two decades now.

Crucially, we set aside the common 10.1 and 10.10 ranges as nonroutable, so any devices that default into those have to be dealt with before they can live on the wider network.

Newcomers get handed a block and have to renumber, or NAT into it, or whatever, but they cannot emit bogons. At a small scale (first-name basis), this works.