# Symptom
Calls that list organization members or roles return 403 for regular members while succeeding for admins.
# Confirm the cause
1. Reading memberships and roles requires the org:sys_memberships:read (or manage) system permission on the caller's membership. Plain members do not have it.
2. Check the caller's membership role in the dashboard and whether that role carries the needed system permission.
3. UI components that list members (like the organization switcher/profile) trigger these calls; they 403 for under-permissioned members rather than returning empty.
# Fix
- Gate member-listing UI on a has() check for the permission, so members never see a broken control.
- Or make the call from your backend with the secret key instead of the user's session, and enforce your own access rule.
# Verify
The same call succeeds for an org admin and fails cleanly (handled 403, no crash) for a plain member. No user sees a raw error page.