I'm a bit tired today so my mind may not work properly...
I see a small inconsistency, should it be "by design" or not I'm not sure.
allowedTo (and isAllowedTo) can be called passing an array of boards and they check if the user is allowed to do anything in these boards.
Though (as far as I can see) that function does not check if boards are accessible.
Am I completely out of track?
Hmm, missing a tiny bit of context, what are you thinking about? It's obvious that basic entrance permissions work, otherwise it'd be some kind of security problem already (I consider accessing team boards a partial security problem, logic-wise, as there can be things regular members should not see)... So are you fiddling with some integrations or else? #Confused O:-)