The Owner works in conjunction with the Security Role Privileges for each Table.
Its not simple to explain fully, but an Owner can be a User or a Team (that has security role privileges that allow it to own the record).
User's and Teams have a Business Unit.
Each Table that was defined as Organization, cannot be owned and the Security Role privilege will only have the None/Full option.
Each Table that was defined as User or Team, has 5 levels for each of the Security Role Priviles (none, user, BU, BU and below, Organization/full)
Think of Business Units (BU) as an Organization Hierarchy, when an owner is set or changed for a record the record essentially becomes part of that user/teams BU (i.e. can move within the hierarchy) - then what the user can do depends on their levels of privileges.
It depends on what you need things to be and how complicated your system is as to what you need e.g. you could give a user or team update privilleges to their Secuitiy Role, and then have a Column Level Security Profile for a specific field so that only those uses with the Profile can update the field. Or you could build a separate approval process using related records, or use an Approval process in Flow.
