Function resolve_ask 

pub fn resolve_ask(
    cache: &ApprovalCache,
    handler: Option<&dyn PermissionsApprovalHandler>,
    req: &ApprovalRequest<'_>,
) -> bool

Resolve one Ask-tier request against the cache + an optional handler: cache hit → true (no handler call); no handler → false (fail-closed); handler Deny/Allow/AllowForSession → false/true/true (recording the grant in cache for the last case). This is the single call site crate::agent::Agent’s gate uses, factored out so it’s unit- testable without a full Agent.