admin_channels work in the way you’ve described - you don’t need to do a dynamic channel grant (via access in the sync function). You can issue a GET for the user via the REST API to verify that the admin channels have been set properly. I can’t tell from the information you’ve provided what’s been misconfigured in your original attempt, but you can check the Sync Gateway logs to see the set of channels being used for a given replication.
I just made another observation: After adding channels to admin_channels and restart of the Sync Gateway these channels have not been added to the user data in Couch (checked with select * from stammdaten use keys “_sync:user:mtmsuser_stammdaten”).
I needed to remove the user using
delete from ticketingsystem use keys "_sync:user:mtmsuser_ticketingsystem"
(which I would have could done via the Admin REST API, but it was easier for me this way).
This is the intended behaviour - admin_channels are only initialized from the config file if the user does not already exist. This is related to what you mention - the user’s admin_channels may have been modified via the REST API, and simply restarting Sync Gateway shouldn’t invalidate the changes made via the REST API.