Organization-wide defaults establish the baseline for records a user doesn't own. Private limits that baseline. Public Read Only opens reading while leaving editing controlled, and Public Read/Write opens both within the user's object permissions. Sharing rules add access; they don't restrict a permissive baseline.
The role hierarchy opens appropriate access upward. Peers in one role do not automatically see one another's private records. Model roles around data access needs rather than copying every job title. A criteria rule selects records by values; an owner rule selects records by ownership. Recipients and access level must be explicit. When a user asks to see a record, find the narrowest justified path and check the reason returned by the access evaluator.