Ghost doesn’t have all the functionality baked in.
Staff users are the only ones who can create posts, and are assumed to be trusted users - their post content is not sanitized. If you don’t trust your staff users you definitely need to put the Ghost admin page on a totally separate domain, and I’m not confident that’s 100% enough. They’d still be able to steal a member’s cookie (used for commenting even if all your users are staff users) with malicious code. Somewhat more in a response to a different user: Sign in as Contributors, Authors, and Editors - #2 by Cathy_Sarisky
There also aren’t ‘likes’ included, and there’s no theme-level way to extend the database and add them. There are permissions, but only to view posts as a member of a paid tier, and users can only be in one tier - there’s missing the concept of ‘my friends can see my content’.
You could potentially sort of implement follows by creating a newsletter for each staff user, but it’d be a hack, and there’s no “ask to be friends and get permission” functionality. Users can sign up for any newsletter.
So you’ve got post creation, and then it gets messy/complicated fast. :)