diff --git a/jey_theme/access_control.py b/jey_theme/access_control.py
index 7cb9fd7..ff563c4 100644
--- a/jey_theme/access_control.py
+++ b/jey_theme/access_control.py
@@ -111,21 +111,25 @@ def before_request():
 
 
 def has_permission(doc=None, ptype=None, user=None, debug=False):
-	"""Per-doc hook. Applies to non-Administrator users that might otherwise have role access."""
+	"""Per-doc hook. Applies to non-Administrator users that might otherwise have role access.
+
+	IMPORTANT: Frappe treats a falsy return (None/False/0) as a denial — see
+	`has_controller_permissions` in frappe/permissions.py. Controllers can only
+	*deny*, never grant — so for the pass-through case we MUST return True."""
 	doctype = None
 	if doc is not None:
 		doctype = getattr(doc, "doctype", None)
 		if doctype is None and isinstance(doc, str):
 			doctype = doc
 	if not doctype:
-		return None
+		return True
 	if is_blocked_doctype(doctype):
 		return False
 	if doctype == "Workspace":
 		module = getattr(doc, "module", None)
 		if module and module in BLOCKED_MODULES:
 			return False
-	return None
+	return True
 
 
 def _filter_list(container, key, predicate):