You have learned that by using security roles, you can restrict user access to specific data records. However, sometimes a user might need access to a data record that isn’t included (access-wise) in his or her security roles. To accommodate this need, you can collaborate through a Microsoft Dynamics CRM concept called sharing. Typically, any record in CRM that can be associated with a customer (lead, account, contact, opportunity, case, quote, and so on) can be shared.
By the Way: Security Roles Cascade Down the Hierarchy
Security roles are created and associated with business units.
Each time you create a new business unit within your hierarchy, it inherits all the security roles associated with the parent business units.