Non of these rules should be set in stone, but there needs to be some structure to ensure this is a productive use of time.
Use one keyboard and screen
Use a private room
Keep time and rotate who is on the keyboard every 10 to 15 minutes.
Everyone gets time at the keyboard, even non-programmers.
Take a story from start to finish, or in other words: from planning to coding, to testing, to done.
Take breaks when you want.
A session should span an entire workday.
These guidelines have worked for some teams, but they're not as structurally important.
4-5 people per session.
Hold regular retrospectives.
Use this time as an opportunity to train.
Invite "spectators" and non-dev stakeholders, but make sure everyone has a reason to be there.
Voluntary attendance; this won't work for everyone.
Adjust often, as needed.