Google's Gerrit Code Review stores its special permissions and such in a meta/ references namespace, which has restricted permissions. So instead of refs/heads/

Google's Gerrit Code Review stores its special permissions and such in a meta/ references namespace, which has restricted permissions. So instead of refs/heads/ for branch names, there's refs/meta/*. The meta space has config files specifying the permissions. Also the config and permissions changes are logged, because they're git commits too. The same could be done without forking git. One could also just have a parallel git repo with config files.