1. A method, comprising: receiving an authentication challenge at a mobile device in connection with an authentication process for a managed application establishing a per-application policy-controlled virtual private network (VPN) tunnel that is inaccessible to other applications of the mobile device; analyzing policy information to determine that the policy information allows the mobile device to respond to the authentication challenge instead of a user or the managed application, wherein the policy information describes one or more policies for providing the managed application with access to at least one resource accessible through an access gateway; responding, by the mobile device, to the authentication challenge instead of the user or the managed application; providing the managed application with access to the at least one resource based at least on the per-application policy-controlled VPN tunnel, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, and the policy information, wherein the ticket includes a validity duration; transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.