A policy device comprising: means configured to receive, via an access device coupled to the policy device, a session identifier from a client device, wherein the policy device comprises an individually administered autonomous policy server that stores and applies a plurality of policies to control access to a network, and the means configured to receive the session identifier comprises a network interface, wherein the session identifier uniquely identifies a communication session previously established between the client device and the network, wherein the policy device comprises a first policy device and the session identifier is generated by a second policy device that has separately and autonomously authenticated the client device; a session management module configured to, in response to the session identifier being received by the means configured to receive a session identifier from a client device, retrieve session information corresponding to the session identifier, wherein the session management module is configured to retrieve the session information from a session store, wherein the session store stores session information of a plurality of network sessions for the network published by a plurality of policy devices (20A, 20B); and means configured to grant the client device access to the network protected by the policy device based on the session identifier without requesting authentication credentials from a user of the client device, wherein the means configured to grant the client access comprises an authentication and authorization module, wherein the authentication and authorization module grants the client device access to the network by validating that the session identifier matches a session identifier for the previously established communication session between the client device and the network, and wherein the session management module is further configured to assert ownership of the network session to remove a prior ownership of the network session associated with the client device from the second policy device upon granting network access to the client device and updates session information corresponding to the session identifier stored in the session store to reflect the ownership change. means configured to receive, via an access device coupled to the policy device, a session identifier from a client device, wherein the policy device comprises an individually administered autonomous policy server that stores and applies a plurality of policies to control access to a network, and the means configured to receive the session identifier comprises a network interface, wherein the session identifier uniquely identifies a communication session previously established between the client device and the network, wherein the policy device comprises a first policy device and the session identifier is generated by a second policy device that has separately and autonomously authenticated the client device; a session management module configured to, in response to the session identifier being received by the means configured to receive a session identifier from a client device, retrieve session information corresponding to the session identifier, wherein the session management module is configured to retrieve the session information from a session store, wherein the session store stores session information of a plurality of network sessions for the network published by a plurality of policy devices (20A, 20B); and means configured to grant the client device access to the network protected by the policy device based on the session identifier without requesting authentication credentials from a user of the client device, wherein the means configured to grant the client access comprises an authentication and authorization module, wherein the authentication and authorization module grants the client device access to the network by validating that the session identifier matches a session identifier for the previously established communication session between the client device and the network, and wherein the session management module is further configured to assert ownership of the network session to remove a prior ownership of the network session associated with the client device from the second policy device upon granting network access to the client device and updates session information corresponding to the session identifier stored in the session store to reflect the ownership change.