diff --git a/app/(app)/layout.tsx b/app/(app)/layout.tsx
index 6bbab55..7f9a9ac 100644
--- a/app/(app)/layout.tsx
+++ b/app/(app)/layout.tsx
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { redirect } from 'next/navigation'
 import { AppSidebar } from '@/components/app-sidebar'
 import { CommandPalette } from '@/components/command-palette'
+import { hasPermission } from '@/lib/permissions-cache'
 import { ConfirmProvider } from '@/components/ui/confirm'
 import { getRoleLabelMap } from '@/lib/role-labels'
 
@@ -69,11 +70,9 @@ export default async function AppLayout({ children }: { children: React.ReactNod
   const navPerms: Record<string, boolean> = {}
   if (!isAdminRole) {
     const results = await Promise.all(
-      NAV_PERM_CODES.map(perm =>
-        supabase.rpc('user_has_permission', { uid: user.id, sid: member.space_id, perm }),
-      ),
+      NAV_PERM_CODES.map(perm => hasPermission(user.id, member.space_id, perm)),
     )
-    NAV_PERM_CODES.forEach((perm, i) => { navPerms[perm] = !!results[i].data })
+    NAV_PERM_CODES.forEach((perm, i) => { navPerms[perm] = results[i] })
   }
 
   return (
diff --git a/app/(app)/members/page.tsx b/app/(app)/members/page.tsx
index e70a695..1b9e489 100644
--- a/app/(app)/members/page.tsx
+++ b/app/(app)/members/page.tsx
@@ -1,5 +1,6 @@
 import { createClient } from '@/lib/supabase/server'
 import { PageHeader, PageTitle } from '@/components/ui/page-title'
+import { hasPermission } from '@/lib/permissions-cache'
 import { MembersClient } from './members-client'
 import { InvitesPanel } from '../customize/panels/invites-panel'
 
@@ -90,21 +91,13 @@ export default async function MembersPage() {
   // certifications.grant (the Instructor capability) is independent of
   // admin/board, so check it explicitly to decide whether to show the
   // per-member certifications panel.
-  const { data: canGrantCerts } = await supabase.rpc('user_has_permission', {
-    uid: user.id,
-    sid: self.space_id,
-    perm: 'certifications.grant',
-  })
-  const { data: canManageCards } = await supabase.rpc('user_has_permission', {
-    uid: user.id,
-    sid: self.space_id,
-    perm: 'door.manage',
-  })
-  const { data: canViewForms } = await supabase.rpc('user_has_permission', {
-    uid: user.id,
-    sid: self.space_id,
-    perm: 'forms.manage',
-  })
+  // Request-cached: door.manage / forms.manage here dedupe with the layout's
+  // nav-permission resolution for the same render.
+  const [canGrantCerts, canManageCards, canViewForms] = await Promise.all([
+    hasPermission(user.id, self.space_id, 'certifications.grant'),
+    hasPermission(user.id, self.space_id, 'door.manage'),
+    hasPermission(user.id, self.space_id, 'forms.manage'),
+  ])
 
   return (
     <MembersClient
diff --git a/lib/permissions-cache.ts b/lib/permissions-cache.ts
new file mode 100644
index 0000000..5a6de87
--- /dev/null
+++ b/lib/permissions-cache.ts
@@ -0,0 +1,16 @@
+import { cache } from 'react'
+import { createClient } from '@/lib/supabase/server'
+
+// Request-scoped memoized permission check. The same (uid, sid, perm) is
+// resolved at most once per server render, so the layout and the page it
+// renders no longer double-round-trip the `user_has_permission` RPC for
+// overlapping permissions (e.g. door.manage / forms.manage). Semantics are
+// identical to calling the RPC directly -- this only dedupes, it does NOT
+// reimplement permission logic (that stays in the SQL function + RLS).
+export const hasPermission = cache(
+  async (uid: string, sid: string, perm: string): Promise<boolean> => {
+    const supabase = await createClient()
+    const { data } = await supabase.rpc('user_has_permission', { uid, sid, perm })
+    return !!data
+  },
+)