Object permissions decide whether a user can read, create, edit, or delete records of an object. Record sharing decides which records those actions can reach. Field permissions narrow the readable and editable fields within accessible records. A sharing rule cannot repair a missing object Read permission.
Profiles establish a baseline. Use a small baseline and add job-specific grants through permission sets when possible. View All and Modify All bypass ordinary record sharing for an object; their scope is much wider than opening one team's records. Check both an allowed and denied action when you handle an access request. A user who should read a record may still need its sensitive field hidden and its Delete action unavailable.