Four short rules. The second is the one that catches people out, so read it carefully.
1. A field with nothing set is open
A field where every group is left on inherit behaves exactly as it does today — available to everyone with access to the datastore. This is what makes Field Security safe to introduce to a running system: until you set something, nothing changes.
2. As soon as you set any group on a field, everyone else loses access
Setting one group's level on a field pushes every group you have not set down to No Access.
So giving Finance Write on a salary field does not simply add Finance — it removes everybody else. That is usually exactly what you want, but it means a single grant is never an incremental change. Set your baseline at the same time.
3. "All Users (default)" is your baseline
The built-in All Users row applies to everyone. Setting All Users to Read-only and Finance to Write gives the usual intent: everyone can see it, only Finance can change it.
4. The most permissive level wins
Where a user is in several groups with different levels on the same field, the highest applies. Somebody in both a Read-only group and a Write group gets Write.
A worked example
On a salary field: HR set to Write, Line Managers set to Read-only, and nothing set for anybody else. The result is that HR can see and change it, line managers can see it, and everyone else cannot see it at all — without you having to set anything to hide it. That follows automatically from rule 2.
Field Security never widens access
Granting a group Write on a field does not give them access to the datastore. Datastore permissions are checked first; Field Security only narrows what happens within access somebody already has.