Function opa_cache_admission 

pub fn opa_cache_admission(
    now_ms: i128,
    expires_at_ms: i128,
    cached_decision: OpaAuthorizationDecision,
) -> OpaCacheAdmission

Reuse an entry’s decision only while its deadline is strictly in the future.

The caller passes only an entry found under the complete authorization key; the host’s hash-map lookup on that key is what makes it an exact match. The exact deadline is already stale.