A secure external-user sharing model starts with Private external organization-wide defaults. Salesforce explicitly recommends configuring external OWD as Private whenever possible so authenticated Experience Cloud users cannot see records that they do not own or that have not otherwise been shared with them.

After establishing this restrictive baseline, Sharing Sets provide the controlled mechanism for granting external users access to the particular Accounts, Cases, Contacts, applications, and other records associated with their own Account or Contact relationships. Salesforce specifically documents this pattern for external and high-volume community users. This design follows least privilege: nothing is exposed by default, and the site user receives only the application and service records required for their own interaction with the agency. Traditional sharing rules can be useful for external users with roles, but they are not the universal mechanism for high-volume Experience Cloud users. Sharing Sets are purpose-built for these relationship-based external access scenarios. Hidden is not an available organization-wide default record-access level. Salesforce documents external access values such as Private, Public Read Only, Public Read/Write, and Controlled by Parent where applicable.

Study Guide References: Experience Cloud Security; External Organization-Wide Defaults; Sharing Sets; Customer Community; Grants Application Security.