A defense that operates after access control has already succeeded
A watermark embeds a marker, visible or imperceptible, into a piece of shared content that's unique to the specific copy given to a specific recipient. If that copy later leaks, the marker identifies which recipient's copy it was — even when the leaked content otherwise looks identical to every other copy that was legitimately distributed to other recipients.
This is a different kind of control from access control itself: access control decides who receives a copy in the first place; watermarking operates entirely after that decision has already succeeded, addressing what happens once a legitimately-received copy is then leaked or misused by whoever received it.
Changing the incentive rather than preventing the act
Watermarking doesn't prevent a leak from happening — a determined recipient can still leak their copy regardless of what's embedded in it. What it changes is the incentive around doing so: a recipient aware that their specific copy is individually traceable back to them faces a real, personal, attributable consequence for being the identified source, rather than the comfortable anonymity of being one indistinguishable copy among many identical ones with no way to tell which recipient a given leak came from.