access/access.go
func Refresh() error {
    accessLock.Lock()
    defer accessLock.Unlock()


Is it necessary to lock that, too? Don't know... how to lock that?

ssh/commands/serve.go
    if s.repoName == access.AdminRepo() {
        zap.S().Info("admin repo updated, refreshing access control")

        return access.Refresh()
    }


Maybe this can be "removed" as fsnotify retriggers automatically the Refresh now.

Maybe we should add the parent directory only if not already watched. Otherwise we will watch all content in that directory, too. That would be nice in hgkeeper working directory. But Refresh() hgkeeper repo stuff if another repository has an updated working-directory is strange.
Maybe you want to change this a little bit. :-)

you can drop waitForEvent and just use a break on line 24.

This code assumes that the go routine for previous watcher has finished. I'm not very familar with the fsnotify package, but I'm also worried we're going to trigger this a lot.
For example, a push to the admin repo is going create multiple file system events, which, if I'm not mistaken, is going to run the refresh multiple times when it really just needs to be once during that push.
Maybe we need to cancel the fsnotify.Watcher while we're getting an admin repo update?
That wouldn't cover the case where someone renames a repository and a bunch of files change though. So maybe we need a way to manually add stop and create the watcher, so that we can better control it.
For example, during admin repo push, stop the watcher, handle the push, and then access.Refresh and tell it to create the fsnotify.Watcher. 
Likewise, the fsnotify.Watcher should ignore additional events for some duration of time, or not create itself until the queue of events is gone?
Actually do we need to recreate this each time? If we can just have a single instance and tell it to ignore events for a bit, that seems like the best case.

I will try something else... so lets wait here. :-)