What should the Architect do to ensure Field-Level Security is enforced on a custom Visualforce page using the Standard Lead Controller?

Universal Container (UC) wants all full-time internal employees to be able to view all leads. A subset of employees should also be able to see leads.
Which organization default (OWD) approach should an architect recommend that will help US implement these requirement?

Universal Containers has just deployed a change to its role hierarchy. A manager is reporting that their staff can now see Accounts that they do not own and should not have access to. How should the Architect troubleshoot?

...From customers on company Issued desktops and uses case object to track customer issues and grievances. The company would like to capture images of customer site captured by field consultants while they are editing the case record during customer site visit. The Director of IT wants to minimize customization and promote reusability of code artifacts wherever possible, what recommendations should an architect give to the company to implement the image capture requirement, while ensuring customer that the service rep can continue to use same lightning pages they were trained to use?

Universal Containers (UC) sales managers are complaining that they cannot access their teams' Shipment records (a custom object). Initially, the admin suggested that this is happening due to a misconfigured Role Hierarchy (Shipment organization-wide default is Private). After investigation, they determined the Role Hierarchy for these users is correct.
What is the reason why UC sales managers are unable to see shipment records?