How would you explain organization-wide defaults to a business stakeholder, and how do you choose one?

I describe the OWD as the answer to the question: what should someone see who has no other relationship to this record? Everything else in the sharing model only ever opens access further, so the OWD is the floor and it should be set to the most restrictive value the business can tolerate.

The main choices are Private, Public Read Only, Public Read/Write, and Controlled by Parent for child objects whose access follows a parent. Some objects add their own values — Public Read/Write/Transfer on Leads and Cases, Public Full Access on Campaign, and a separate set of levels on Price Book — so it is worth checking the specific object rather than assuming a universal list. There is also a separate external default that governs external users and cannot be less restrictive than the internal one.

My working method is to start at Private for anything sensitive and then justify every relaxation with a concrete requirement. That is not just caution — it is easier to open access later than to tighten it, because tightening an OWD on a large object triggers a full sharing recalculation and usually breaks something that had quietly come to depend on the loose setting.