A session host apparatus (606/704), comprising: a processor controlling operations of the session host apparatus (606/704); and memory storing computer readable instructions that, when executed by the processor, cause the session host apparatus (606/704) to establish a session with a session client by: receiving a lease token associated with a session client, wherein the lease token is a self-sustaining package of cryptographically signed connection lease data from which the session host apparatus (606/704) can determine whether the session client device (405a-405n) is authorized to access one or more resources hosted by the session host (606/704) regardless of an outage at a trusted connection broker, wherein the lease token is generated by and signed by the trusted connection broker, and wherein the lease token comprises a plurality of data fields, each data field defining a different one of a lease ID, a set of one or more client devices, a set of one or more session hosts, and a set of one or more resources; validating the lease token based on a cryptographic signature of the trusted connection broker; determining, based on the verified lease token and without querying the trusted connection broker that generated the lease token, one or more resources, hosted by the session host apparatus (606/704), that the session client is authorized to access; sending session connection information to the session client based on the determined resources, after determining that the session client is authorized to access the one or more resources; establishing a session with the session client, based on the session connection information; and providing the session client access to the one or more determined resources through the established session. a processor controlling operations of the session host apparatus (606/704); and memory storing computer readable instructions that, when executed by the processor, cause the session host apparatus (606/704) to establish a session with a session client by: receiving a lease token associated with a session client, wherein the lease token is a self-sustaining package of cryptographically signed connection lease data from which the session host apparatus (606/704) can determine whether the session client device (405a-405n) is authorized to access one or more resources hosted by the session host (606/704) regardless of an outage at a trusted connection broker, wherein the lease token is generated by and signed by the trusted connection broker, and wherein the lease token comprises a plurality of data fields, each data field defining a different one of a lease ID, a set of one or more client devices, a set of one or more session hosts, and a set of one or more resources; validating the lease token based on a cryptographic signature of the trusted connection broker; determining, based on the verified lease token and without querying the trusted connection broker that generated the lease token, one or more resources, hosted by the session host apparatus (606/704), that the session client is authorized to access; sending session connection information to the session client based on the determined resources, after determining that the session client is authorized to access the one or more resources; establishing a session with the session client, based on the session connection information; and providing the session client access to the one or more determined resources through the established session. receiving a lease token associated with a session client, wherein the lease token is a self-sustaining package of cryptographically signed connection lease data from which the session host apparatus (606/704) can determine whether the session client device (405a-405n) is authorized to access one or more resources hosted by the session host (606/704) regardless of an outage at a trusted connection broker, wherein the lease token is generated by and signed by the trusted connection broker, and wherein the lease token comprises a plurality of data fields, each data field defining a different one of a lease ID, a set of one or more client devices, a set of one or more session hosts, and a set of one or more resources; validating the lease token based on a cryptographic signature of the trusted connection broker; determining, based on the verified lease token and without querying the trusted connection broker that generated the lease token, one or more resources, hosted by the session host apparatus (606/704), that the session client is authorized to access; sending session connection information to the session client based on the determined resources, after determining that the session client is authorized to access the one or more resources; establishing a session with the session client, based on the session connection information; and providing the session client access to the one or more determined resources through the established session.