1. A method, comprising: detecting that an application is capable of running in both a first mode and a second mode on a mobile device, wherein the first mode is a managed mode operating under the control of one or more policies separate from the application and usable to manage operations of multiple applications executing on the mobile device; running, on the mobile device, the application in the first mode; and when the application is running in the first mode, providing the application with access to at least one resource accessible through an access gateway based at least on a virtual private network (VPN) tunnel for the application to the at least one resource, a ticket configured to provide authentication in connection with creating the VPN tunnel, and policy information that describes the one or more policies.