Org-wide defaults for record access
Key Takeaway
An organization-wide default (OWD) is the most locked-down level of access anyone starts from on records they don't own, because other sharing features can only add access. When some users need access and others don't, set the OWD to Private and open access as needed.
Organization-wide defaults (OWDs) set the baseline access users have to records they don't own, object by object. They are the starting point of the Salesforce sharing model. Features like the role hierarchy and sharing rules add access on top of them.
The starting point of the sharing model
You set OWDs separately for custom objects and many standard objects. You can also set different levels for internal and external users. Access to documents, reports, and dashboards is different: it depends on the folder they are stored in, not on an OWD.
The role hierarchy, sharing rules, and other record access features can only grant additional access. They can't restrict access below the OWD, so the OWD is the most locked-down level anyone starts from.
When some users need access and others don't, set the OWD to Private. Then open access as needed with sharing rules or the role hierarchy.