Org-wide defaults and role hierarchy as the baseline for client data
Key Takeaway
Lock each object's org-wide default (OWD) to the most restrictive level first. Then open access with the role hierarchy and sharing rules, which can only add access.
Org-wide defaults (OWDs) set the baseline access internal users have to records they don't own, object by object. The role hierarchy is the first tool that opens access above that baseline, so users in higher roles reach the records of users below them. Sharing rules then give other sets of users access. For sensitive client financial data, you lock the baseline down first and open access only where it is needed.
How Salesforce layers data access
Salesforce controls data access in layers. Profiles and permission sets control object-level and field-level access, which decides what a user can do with a type of data. Record-level sharing decides which individual records a user can see. Roles mainly control record-level access through the role hierarchy and sharing rules, so roles and profiles are not interchangeable.
Every record is owned by a user or a queue. The owner has full access to the record. Record-level security builds up in a set order: OWDs first, then the role hierarchy, then sharing rules and other tools that give wider access.
Sharing doesn't replace object permissions, because users need the appropriate object permissions whatever the sharing settings are. If you share an account with a user, the user sees the account only if they have the Read permission on accounts. A user with the Edit permission on contacts still can't edit contacts they don't own when the contact OWD is Private.