Drupal allows you to customize who can view and modify content.
Permissions are defined per entity type in the permissions table.
Set them per entity on it's manage permissions tab.
APIs
Core Permissions
Access Content Permission
Aka "View published content". This is granted to all users by default.
View Own Unpublished Content Permission
If content authors can create unpublished content, they should have access to it as well.
Modules
There are many modules available that restrict access. They are in various states of development, so some digging is needed to find what works.
By Entity type, Content type, or Bundle
Private Content
https://www.drupal.org/project/private_content
Option to set content type to private. Can be overridden per node.
Nodeaccess
https://www.drupal.org/project/nodeaccess
Grant roles access per content type. Users can grant permissions to others.
Content Access
https://www.drupal.org/project/content_access
Role based content type access.