After refactoring...

authorize.ex

defmodule Api.Authorize do
  alias Account.Models.User
  alias Tracker.OrganizationMembers, as: OM

  def board?(board_id, %User{} = user, available_perms, required_perms) do
    with(
      {:ok, board} <- Tracker.Board.find(board_id),
      true <- OM.user_in_organization?(user.id, board.organization_id)
    ) do
      required_perms == common_permissions(required_perms, available_perms)
    else
      _ -> false
    end
  end

  defp common_permissions(required, available) do
    required
    |> MapSet.new()
    |> MapSet.intersection(MapSet.new(available))
    |> Enum.to_list()
  end
end

Could be further improved I'm sure, but for now, I'm happy with it.