Record-level sharing control interaction
Key Takeaway
Set organization-wide defaults (OWD) to what your most restricted user should have, then open access with the role hierarchy, sharing rules, and manual sharing. Those three controls only add access, and object permissions are a ceiling that sharing can't raise.
Record-level sharing decides which individual records a user can see and edit inside an object they already have permission to use. Four controls stack in order of increasing access. Organization-wide defaults lock data down to a baseline, and then the other three controls open access back up for the users who need it.
Object permissions and record access are separate layers
Two separate layers decide what a user can do with a record. Object permissions are one layer: a user's profile, permission sets, and permission set groups decide what they can do on an object. Record-level security is the other layer: it decides which records the user can reach when they don't own them.
So Read or Edit on an object does not mean the user can read or edit every record in it. For example, a user with Edit on contacts still can't edit contacts they don't own when the contact OWD is Private.
Object permissions are also a ceiling that sharing can't raise, so OWD can never grant more access than a user's object permissions. For example, if someone shares an account with a user who doesn't have the Read permission on accounts, that user still can't see the account.