has() returns false for an org admin: there is no active organization in the session

TL;DR: Permission checks fail even though the dashboard shows the user as an admin. The check runs against the active organization, and there is not one. Confirm the cause 1. has() checks permissions against the ACTIVE organization. Read orgId from auth().

The fix

1. has() checks permissions against the ACTIVE organization. Read orgId from auth(). If it is null, the user has no active org selected and every org permission check returns false.
2. If orgId is present, check the permission string character for character. Org permissions are namespaced (for example org:sys_memberships:read). A typo, or a role slug where a permission belongs, fails silently.
3. Custom roles and permissions are defined in the dashboard; the string in code must match the dashboard string exactly.
4. Make the user select or create an organization first (onboarding flow), then re-run the check.
5. Copy permission strings from the dashboard rather than typing them from memory.

When to use this

• This covers exactly what the title says: has() returns false for an org admin.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with has(); these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current has() behavior.

Verified 2026-09-26: community debugging tables list 'orgId is undefined' (no active organization) as the cause of missing org context and 'check has() call matches the permission string in the dashboard' as the fix for insufficient-permissions symptoms. Clerk org permissions use namespaced strings checked against the active organization.