Rudder

When you have a pretty complex environment and regulations, it is required to have separate test, QA and (sometimes multiple) Production instances of Rudder, which have to be separated by network / OS / ops teams.

The easiest setup would be something like

Test -> Prod

A bit more advanced is:

Test -> QA -> Prod

A fair complex scenario would be:

Test -> QA -+--> Prod_1
            |--> Prod_2
            |--> Prod_3

So for developing, you play around in Test, until you have your set of rules done.
When you have tested your own rules on your own, you could <somehow> transfer that set of rules to the QA System, where a separate QA/Test Team could run a test suite, which is required before the new/modified set of rules could "go live".

When you are done with QA, you could sync the tested and accepted Rule(s) to your Prod Server(s), which then could start rolling out the Rules (hwo this to be done should be discussed in a separate User Story).

For this to work, you'd need to have the ability to connect two Root-Servers with Master/Slave roles, where the Master could read the rules (+depending objects, like groups, techniques, ncf methods, but not nodes!), and present it to the Admin, who then could use some UI to select those to be transferred.