A method on a mobile device comprising: detecting that an application (514, 522, 526, 580, 582) is capable of executing in both a first mode and a second mode on the mobile device, wherein the first mode is a managed mode operating under control of one or more policies separate from the application (514, 522, 526) and usable to manage operations of multiple applications (514, 522, 526 580, 582) executing on the mobile device; executing, by the mobile device, the application (514, 522, 526, 580, 582) in the first mode; transmitting, to an access gateway, a ticket configured to provide authentication in connection with establishing a per-application policy-controlled virtual private network tunnel for the application to at least one resource, wherein the ticket includes a validity duration; when the application (514, 522, 526, 580, 582) is executing in the first mode, providing the application (514, 522, 526, 580, 582) with access to the at least one resource through the access gateway based at least on the per-application policy-controlled VPN tunnel, the ticket and policy information that describes the one or more policies; transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time. detecting that an application (514, 522, 526, 580, 582) is capable of executing in both a first mode and a second mode on the mobile device, wherein the first mode is a managed mode operating under control of one or more policies separate from the application (514, 522, 526) and usable to manage operations of multiple applications (514, 522, 526 580, 582) executing on the mobile device; executing, by the mobile device, the application (514, 522, 526, 580, 582) in the first mode; transmitting, to an access gateway, a ticket configured to provide authentication in connection with establishing a per-application policy-controlled virtual private network tunnel for the application to at least one resource, wherein the ticket includes a validity duration; when the application (514, 522, 526, 580, 582) is executing in the first mode, providing the application (514, 522, 526, 580, 582) with access to the at least one resource through the access gateway based at least on the per-application policy-controlled VPN tunnel, the ticket and policy information that describes the one or more policies; transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.