Sharing rules as exceptions to organization-wide defaults
Key Takeaway
Sharing rules can only add access on top of the organization-wide default, never remove it. You can create them for an object only when that default is Public Read Only or Private.
For each object, organization-wide defaults set the baseline access that users have to records they don't own. This baseline is usually fairly restrictive. Sharing rules are automatic exceptions that open access back up for selected groups of users.
Exceptions to the organization-wide default
A sharing rule extends record access to selected users, regardless of where those users sit in the role hierarchy. It only grants wider access, so it can never be stricter than the organization-wide default. You can't use a sharing rule to restrict access below the default level.
Unlike sharing rules, restriction rules narrow access. A restriction rule further limits the records a user can read through sharing settings to only those that match the criteria you set.
You can create sharing rules for an object only when its organization-wide default is Public Read Only or Private. The typical design is a restrictive default plus sharing rules that open access for specific groups.
Every sharing rule answers three questions: which records to share, which users to share them with, and what kind of access to give.