1. A method, comprising: detecting that an application is capable of running in both a first mode and a second mode on a mobile device, wherein the first mode is a managed mode operating under control of one or more policies separate from the application and usable to manage operations of multiple applications executing on the mobile device; running, on the mobile device, the application in the first mode; when the application is running in the first mode under the control of the one or more policies: transmitting, to an access gateway, a ticket configured to provide authentication in connection with establishing a per-application policy-controlled virtual private network (VPN) tunnel for the application to at least one resource, and providing the application with access to the at least one resource via the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration; transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.