Function confirms_unasked 

pub fn confirms_unasked(
    pushed: &PushedRequest,
    record: &DecisionRecord,
    remembered: Option<&Remembered>,
    loader: &Loader,
    now: OffsetDateTime,
) -> bool

Whether this load confirms the sign-in without asking the account, on the approval it remembered. See plan/remembered-consent.md.

Every condition must hold. The client is confidential, so only the holder of its key pushed this request, which is the spec’s rule for silent sign-in. A browser carries its code, and this load is a top-level navigation by a browser signed in as the account, so the code can reach no other browser. The record is live and grants something. And every atom it grants is covered by the grant the account approved for this crate::oauth::client_metadata::ClientKey.

The e-stop is the caller’s to check.