Think of it as being exactly the same problem as "different customers have paid for different features". It's just that only the internal tester customer has paid for this new feature, so far.

How do you handle that? You need a consistent permissions framework.