1. A method, comprising: receiving, at a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway; determining that a ticket stored by the mobile device is valid, wherein the ticket is configured to provide authentication in connection with establishing a per-application policy-controlled virtual private network (VPN) tunnel for the application to the at least one resource, wherein the ticket includes a validity duration; analyzing policy information to determine that network access to the at least one resource is permitted; transmitting the ticket to the access gateway as part of a process of establishing the per-application policy-controlled VPN tunnel that is inaccessible to other applications of the mobile device; accessing the at least one resource via the per-application policy-controlled VPN tunnel; transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, transmitting, during the validity duration, the ticket to the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.