Sharing Security
Permissions associated with User Profiles are not always sufficient when determining access to specific records. Profile security is granted at the Object level. If a particular User Profile has Read/Edit permissions for an Object, by default they have the same permissions at the record level. Sharing security allows you to enforce permissions at the Record level.
Creating Your Private Sharing Model
The default Sharing setting (controlled by Organization-Wide Defaults) is always Public Read/Write for all custom objects. You can restrict any of these defaults by changing settings to Private or Public Read Only. Then use Sharing Rules to allow specific users or groups of users additional access. Rules are typically based on the record owner or Field values on the records in the Object (e.g. for Agreements, "Agreement Type"). You can also decide to grant access using Role hierarchies, meaning access is automatically given to users above the record owner in your organization's hierarchy.
For more information on determining Organization-Wide Defaults and creating Sharing Rules, please refer to Salesforce Documentation here.
