My policy:
1. Do not use your real name on Facebook. If you're using it now, go into your settings and change it immediately. Use some derivation of it so that you don't show up in Google searches when someone from work does search for you. I've seen people do simple things like if your name is John Smith, make your Facebook "Jo Hnsmith" or "Juan Smith." Either that or use some combo of your first and middle names, omitting your last name altogether.
2. Never accept or initiate a friend request w/a superior or direct report...and frankly, it's a pretty bad idea to do so w/a peer too. You never know who will use your personal life against you, even if yours is pretty benign and boring...a-holes will figure out a way to step on you if/when it's in their interest.