Apex runs in system context by default, which means your code ignores sharing rules and can see everything. This covers the four sharing modes, when to use each one, and how to avoid the data visibility bugs that usually surface in production at the worst possible time.
Salesforce Security
OWD, sharing, profiles, permissions -- the full security model.
