# Symptom
`has()` permission checks return false for a user who is clearly an admin of the organization in the dashboard.
# Confirm the cause
1. `has()` checks permissions against the ACTIVE organization. Read orgId from auth(). If it is null, the user has no active org selected and every org permission check returns false.
2. If orgId is present, check the permission string character for character. Org permissions are namespaced (for example org:sys_memberships:read). A typo, or a role slug where a permission belongs, fails silently.
3. Custom roles and permissions are defined in the dashboard; the string in code must match the dashboard string exactly.
# Fix
- Make the user select or create an organization first (onboarding flow), then re-run the check.
- Copy permission strings from the dashboard rather than typing them from memory.
# Verify
Log orgId and the has() result together for the failing user. With an active org and the exact string, an admin's check returns true.