There are no hard rules, just values and precedents. If I were to summarize the precedent, it would be a three-prong test: Do you know about the behavior? Do you contribute to it? Do you have the power to stop it?
If (1) and (2), we're at the Nuremberg threshold. That is, if the crime at hand rises to that of crimes against humanity, (1) and (2) alone should be enough. If it doesn't rise to that level, test (3) comes into question. "Stop" is an ambiguous term, as is "crimes against humanity," so there is a lot of subjectivity here.
But to take your analogy, no, a San Francisco warehouse worker at Cisco wouldn't be culpable for e.g. their CFO bribing a foreign official. A content buyer at Instagram isn't responsible for the slave ads. But engineers deploying the ad systems, incentivized by ad metrics? Business development? Any executive at Facebook? Somewhat to totally culpable.