Organization.may_access(): only if verified and active