Configuration and Setup
Two different questions
Salesforce record access answers two questions separately. Object and field permissions (the what) come from profiles and permission sets. Record access (the which rows) comes from org-wide defaults, the role hierarchy, sharing rules, queues, teams, and manual sharing. Distractors swap these constantly. A profile never grants record access by itself; a role never grants a field edit.
Setup decisions that are hard to reverse
Multi-currency cannot be turned off once enabled, and dated exchange rates mean the same amount converts differently depending on the date. Delegated administration is scoped: a delegated admin manages only the roles and profiles you assign, plus the objects you allow. Login As is always recorded in the Setup Audit Trail. My Domain is a prerequisite for SSO and for deploying Lightning components to the org.
Sandboxes and deployment
Developer and Developer Pro sandboxes refresh daily (10 MB and 1 GB of data); Partial Copy and Full Copy refresh every 29 days, with Partial Copy using a sandbox template to pull a sample of data. Change sets move metadata only between orgs connected to each other, and a change set cannot delete metadata in the target.
Worked example
A support agent can open a case owned by a teammate even though Case OWD is Private. Check in order: (1) is the teammate below the agent in the role hierarchy with Grant Access Using Hierarchies enabled; (2) is the agent a member of the case's queue; (3) is there a sharing rule, case team, or manual share? The profile is almost never the answer.
Rule of thumb: if the user sees some records, it is a record-access question; if they cannot see a field or button at all, it is a profile or permission-set question.