Define the default access level for an object’s records with organization-wide sharing settings. Organization-wide sharing settings can be set separately for custom objects and many standard objects, and you can set different levels of access for internal and external users.
For most objects, organization-wide sharing settings can be set to Private, Public Read Only, or Public Read/Write. In environments where the organization-wide sharing setting for an object is Private or Public Read Only, an admin can grant users additional access to records by setting up a role hierarchy or defining sharing rules. However, sharing rules can only be used to grant additional access—they can’t be used to restrict access to records beyond what was originally specified with the organization-wide sharing defaults.
Organization-Wide Sharing Defaults - https://help.salesforce.com/articleView?id=security_sharing_owd_about.htm&type=5
Organization-Wide Default Access Settings - https://help.salesforce.com/articleView?err=1&id=sharing_model_fields.htm&type=5