On top on that, here additional items to note:
- Profile in step 1 include Permission Set
- Before step 3, a check if user have permissions to View All record for that object defined in Profile or Permission Set
- Account owner will able to access any Contact and Opportunity owned by other user
- Owner of parent record in Master-Detail able to access all child records
- User in Account Team, Case Team and Opportunity Team able to access the record
- Quick Reference – How Salesforce Determines Record Access for a User?
- Record-Level Access: Under the Hood