The Mandatory Permissions Rulesets control the minimum set of permissions each record has.  The Mandatory Permissions are combined with the Sharing Policies to set the permissions for each record.

The default setup for Mandatory Permissions is to apply the Minimum Access Ruleset.

You can see the Mandatory Permissions by going to Start > Configuration > Users & Security > Permissions then selecting the 'Mandatory Permissions' Tab, followed by the 'Manage Mandatory Rulesets' at the top of the form and selecting the Minimum Access Ruleset.

As you can see from the screenshot above the default configuration is to allow System Admin Users to have full access to records and for everyone else to have read access to records they own.

If you add a new rule into the ruleset e.g. Managers to Read all records, then this new rule is applied to all existing and new records.