Internal versus external organization-wide defaults
Key Takeaway
Each supported object has one organization-wide default (OWD) for internal users and a separate one for external authenticated users. The external level must be equal to or more restrictive than the internal level.
Organization-wide defaults (OWDs) set the baseline access users have to records they don't own. For each supported object, you can set one baseline for internal users, called Default Internal Access. You can set a separate baseline, called Default External Access (the external OWD), for external authenticated users such as Partner users and Experience Cloud site users. So you can keep data fairly open inside the company while you lock it down for external authenticated users. You can then open up specific records with other record access features.
OWDs and other record access features
Other record access features, such as the role hierarchy and sharing rules, can only grant additional access on top of the OWD. They can't restrict access below what the OWD allows.