...for example, WordPress core has fairly limited user permissions,” he said.

WordPress' core roles and capabilities API is pretty comprehensive. And with the 'map_meta_cap' and 'user_has_cap' filters, you can make the editing and publishing process dance to any tune.

A great overview -- https://speakerdeck.com/johnbillion/a-deep-dive-into-the-roles-and-capabilities-api