@@ -870,7 +870,7 @@ async fn run_lifecycle(
                 binary_path: host_proxy_binary_path(&sandbox_config),
                 sandbox_id: Some(sandbox_id.clone()),
                 sandbox_name: Some(sandbox_name.clone()),
-                openshell_endpoint: None,
+                gateway: None,
                 provider_credentials: None,
                 agent_proposals: openshell_core::proposals::AgentProposals::default(),
                 denial_tx: None,
 
@@ -14,3 +14,15 @@ allocator implementation belongs to the VM crate. The VM dependency disables
 default features, so this instrumentation does not
 require the compute runtime or Unix-only sandbox library. It is a development
 dependency only.
+
+## Session inputs
+
+`run_networking` takes a `NetworkSession` with the sandbox identity, the
+session's `GatewayEndpoint`, the SPIFFE Workload API socket for provider token
+grants, the `policy.local` denial source, and proxy CA files. None of these
+are read from the process environment, so one process can run several
+sessions. Each session owns its provider token cache and HTTP client; a token
+acquired for one sandbox is never served to another. Without a Workload API
+socket, token grants fail closed. A process hosting several sessions serves
+`/v1/denials` from a per-session `SessionDenialLog` instead of the shared
+shorthand log files.
@@ -48,7 +48,8 @@ pub struct HostProxyConfig {
     pub binary_path: PathBuf,
     pub sandbox_id: Option<String>,
     pub sandbox_name: Option<String>,
-    pub openshell_endpoint: Option<String>,
+    /// Gateway access with this sandbox's credentials.
+    pub gateway: Option<openshell_core::grpc_client::GatewayEndpoint>,
     pub provider_credentials: Option<ProviderCredentialState>,
     /// Shared feature state for the policy.local agent proposal surface.
     pub agent_proposals: AgentProposals,
@@ -99,7 +100,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result<HostProxyHandle
     let (_workspace_tx, workspace_rx) = tokio::sync::watch::channel(String::new());
     let policy_local_ctx = Arc::new(PolicyLocalContext::new(
         Some(config.policy.clone()),
-        config.openshell_endpoint.clone(),
+        config.gateway.clone(),
         config
             .sandbox_name
             .clone()
 
@@ -53,18 +53,26 @@ pub trait TokenGrantResolver: Send + Sync {
     ) -> Pin<Box<dyn Future<Output = Result<String, TokenGrantFailure>> + Send + 'a>>;
 }
 
-/// Resolves provider tokens using the supervisor's authenticated grant flow.
-#[derive(Default)]
-pub struct SpiffeTokenGrantResolver;
+/// Resolves provider tokens through one session's authenticated grant flow.
+pub struct SpiffeTokenGrantResolver {
+    grants: crate::token_grant::SessionTokenGrants,
+}
+
+impl SpiffeTokenGrantResolver {
+    #[must_use]
+    pub fn new(grants: crate::token_grant::SessionTokenGrants) -> Self {
+        Self { grants }
+    }
+}
 
 impl TokenGrantResolver for SpiffeTokenGrantResolver {
     fn obtain<'a>(
         &'a self,
         request: TokenGrantRequest<'a>,
     ) -> Pin<Box<dyn Future<Output = Result<String, TokenGrantFailure>> + Send + 'a>> {
         Box::pin(async move {
-            crate::token_grant::obtain_provider_token(
-                crate::token_grant::ObtainProviderTokenRequest {
+            self.grants
+                .obtain_provider_token(crate::token_grant::ObtainProviderTokenRequest {
                     provider_name: request.provider_key,
                     token_endpoint: request.token_endpoint,
                     jwt_svid_audience: request.jwt_svid_audience,
@@ -75,18 +83,12 @@ impl TokenGrantResolver for SpiffeTokenGrantResolver {
                     grant_type: request.grant_type,
                     requested_token_type: request.requested_token_type,
                     request_id: request.request_id,
-                },
-            )
-            .await
+                })
+                .await
         })
     }
 }
 
-/// Construct the production SPIFFE-backed resolver.
-pub fn default_resolver() -> Arc<dyn TokenGrantResolver> {
-    Arc::new(SpiffeTokenGrantResolver)
-}
-
 /// A refused request: the grant failure and the credential whose grant failed.
 ///
 /// The credential is the `provider:credential` name pair of the selected
 
@@ -3,7 +3,9 @@
 
 //! Sandbox-local policy advisor HTTP API.
 
+use crate::l7::token_grant_injection::TokenGrantResolver;
 use miette::{IntoDiagnostic, Result};
+use openshell_core::grpc_client::GatewayEndpoint;
 use openshell_core::proposals::AgentProposals;
 use openshell_core::proto::{
     L7Allow, L7DenyRule, L7Rule, NetworkBinary, NetworkEndpoint, NetworkPolicyRule, PolicyChunk,
@@ -82,50 +84,153 @@ const SHORTHAND_LOG_PREFIX: &str = "openshell.";
 /// log entry (very long URL path, etc.) cannot blow up the response.
 const MAX_DENIAL_LINE_BYTES: usize = 4096;
 
-#[derive(Debug)]
+/// Most recent denial lines retained for one hosted session.
+const MAX_SESSION_DENIAL_LINES: usize = 256;
+
+/// Where `/v1/denials` reads this sandbox's recent denials.
+#[derive(Clone, Debug)]
+pub enum DenialLogSource {
+    /// Shorthand log files written by a supervisor process that serves one
+    /// sandbox.
+    ShorthandFiles(PathBuf),
+    /// Denials recorded for this session alone. A process hosting several
+    /// sandboxes cannot expose its shared log files to any one of them.
+    Session(SessionDenialLog),
+}
+
+impl Default for DenialLogSource {
+    fn default() -> Self {
+        Self::ShorthandFiles(PathBuf::from(LOG_DIR))
+    }
+}
+
+/// Bounded recent OCSF denial lines recorded for one hosted session.
+#[derive(Clone, Default)]
+pub struct SessionDenialLog {
+    lines: Arc<std::sync::Mutex<std::collections::VecDeque<String>>>,
+}
+
+impl std::fmt::Debug for SessionDenialLog {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let retained = self
+            .lines
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .len();
+        formatter
+            .debug_struct("SessionDenialLog")
+            .field("retained", &retained)
+            .finish()
+    }
+}
+
+impl SessionDenialLog {
+    /// Retain `line` when it is a rendered OCSF denial; ignore anything else.
+    pub fn record(&self, line: &str) {
+        let line = line.trim_end();
+        if !is_ocsf_denial_line(line) {
+            return;
+        }
+        let mut lines = self
+            .lines
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if lines.len() == MAX_SESSION_DENIAL_LINES {
+            lines.pop_front();
+        }
+        lines.push_back(line.to_string());
+    }
+
+    fn recent(&self, limit: usize) -> Vec<String> {
+        self.lines
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .iter()
+            .rev()
+            .take(limit)
+            .map(|line| surfaced_denial_line(line))
+            .collect()
+    }
+}
+
 pub struct PolicyLocalContext {
     current_policy: Arc<RwLock<Option<Arc<ProtoSandboxPolicy>>>>,
     agent_proposals: AgentProposals,
-    gateway_endpoint: Option<String>,
+    gateway: Option<GatewayEndpoint>,
     sandbox_name: Option<String>,
-    shorthand_log_dir: PathBuf,
+    denials: DenialLogSource,
+    token_grants: Option<Arc<dyn TokenGrantResolver>>,
     workspace_rx: tokio::sync::watch::Receiver<String>,
 }
 
+impl std::fmt::Debug for PolicyLocalContext {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("PolicyLocalContext")
+            .field("gateway", &self.gateway)
+            .field("sandbox_name", &self.sandbox_name)
+            .field("denials", &self.denials)
+            .field("token_grants", &self.token_grants.is_some())
+            .finish_non_exhaustive()
+    }
+}
+
 impl PolicyLocalContext {
     pub fn new(
         current_policy: Option<ProtoSandboxPolicy>,
-        gateway_endpoint: Option<String>,
+        gateway: Option<GatewayEndpoint>,
         sandbox_name: Option<String>,
         agent_proposals: AgentProposals,
         workspace_rx: tokio::sync::watch::Receiver<String>,
     ) -> Self {
-        Self::with_log_dir(
-            current_policy,
-            gateway_endpoint,
-            sandbox_name,
+        Self {
+            current_policy: Arc::new(RwLock::new(current_policy.map(Arc::new))),
             agent_proposals,
-            PathBuf::from(LOG_DIR),
+            gateway,
+            sandbox_name,
+            denials: DenialLogSource::default(),
+            token_grants: None,
             workspace_rx,
-        )
+        }
     }
 
+    #[cfg(test)]
     fn with_log_dir(
         current_policy: Option<ProtoSandboxPolicy>,
-        gateway_endpoint: Option<String>,
+        gateway: Option<GatewayEndpoint>,
         sandbox_name: Option<String>,
         agent_proposals: AgentProposals,
         shorthand_log_dir: PathBuf,
         workspace_rx: tokio::sync::watch::Receiver<String>,
     ) -> Self {
-        Self {
-            current_policy: Arc::new(RwLock::new(current_policy.map(Arc::new))),
-            agent_proposals,
-            gateway_endpoint,
+        Self::new(
+            current_policy,
+            gateway,
             sandbox_name,
-            shorthand_log_dir,
+            agent_proposals,
             workspace_rx,
-        }
+        )
+        .with_denial_log(DenialLogSource::ShorthandFiles(shorthand_log_dir))
+    }
+
+    /// Serve `/v1/denials` from `denials` instead of the process log files.
+    #[must_use]
+    pub fn with_denial_log(mut self, denials: DenialLogSource) -> Self {
+        self.denials = denials;
+        self
+    }
+
+    /// Acquire provider token grants for this sandbox's HTTP relays.
+    #[must_use]
+    pub fn with_token_grants(mut self, resolver: Arc<dyn TokenGrantResolver>) -> Self {
+        self.token_grants = Some(resolver);
+        self
+    }
+
+    /// The session's provider token grant resolver, absent when grants are
+    /// unavailable and must fail closed.
+    pub(crate) fn token_grant_resolver(&self) -> Option<Arc<dyn TokenGrantResolver>> {
+        self.token_grants.clone()
     }
 
     pub async fn set_current_policy(&self, policy: ProtoSandboxPolicy) {
@@ -318,7 +423,18 @@ async fn recent_denials_response(
     query: &str,
 ) -> (u16, serde_json::Value) {
     let limit = parse_last_query(query).unwrap_or(DEFAULT_DENIALS_LIMIT);
-    let log_dir = ctx.shorthand_log_dir.clone();
+    let log_dir = match &ctx.denials {
+        DenialLogSource::ShorthandFiles(log_dir) => log_dir.clone(),
+        DenialLogSource::Session(log) => {
+            return (
+                200,
+                serde_json::json!({
+                    "denials": log.recent(limit),
+                    "log_available": true,
+                }),
+            );
+        }
+    };
 
     // Distinguish "shorthand log exists and no denials happened" from "no log
     // file yet, so we have nothing to read." Without this flag the agent sees
@@ -398,9 +514,7 @@ fn read_recent_denial_lines(log_dir: &Path, limit: usize) -> Vec<String> {
             // proxy.rs FORWARD path so the on-disk shorthand log itself is
             // clean — tracked separately). Redact first so truncation cannot
             // slice mid-secret.
-            let redacted = redact_query_strings(line);
-            let surfaced = truncate_at_char_boundary(&redacted, MAX_DENIAL_LINE_BYTES);
-            lines.push(surfaced);
+            lines.push(surfaced_denial_line(line));
             if lines.len() >= limit {
                 return lines;
             }
@@ -409,6 +523,11 @@ fn read_recent_denial_lines(log_dir: &Path, limit: usize) -> Vec<String> {
     lines
 }
 
+fn surfaced_denial_line(line: &str) -> String {
+    let redacted = redact_query_strings(line);
+    truncate_at_char_boundary(&redacted, MAX_DENIAL_LINE_BYTES)
+}
+
 /// Replace any `?<query>` substring with `?[redacted]` to keep query-string
 /// secrets out of the agent's view. Walks per Unicode scalar value so multi-byte
 /// content is safe. A query is everything from `?` until the next whitespace or
@@ -486,7 +605,7 @@ fn collect_shorthand_log_files(log_dir: &Path, max_files: usize) -> std::io::Res
 }
 
 async fn submit_proposal(ctx: &PolicyLocalContext, body: &[u8]) -> (u16, serde_json::Value) {
-    let Some(endpoint) = ctx.gateway_endpoint.as_deref() else {
+    let Some(gateway) = ctx.gateway.as_ref() else {
         return (
             503,
             serde_json::json!({
@@ -526,7 +645,7 @@ async fn submit_proposal(ctx: &PolicyLocalContext, body: &[u8]) -> (u16, serde_j
         Err(error) => return (400, error_payload("invalid_proposal", error)),
     };
 
-    let client = match openshell_core::grpc_client::CachedOpenShellClient::connect(endpoint).await {
+    let client = match openshell_core::grpc_client::CachedOpenShellClient::connect(gateway).await {
         Ok(client) => {
             client.set_workspace(workspace);
             client
@@ -956,7 +1075,7 @@ struct LookupSession<'a> {
 async fn open_lookup_session(
     ctx: &PolicyLocalContext,
 ) -> std::result::Result<LookupSession<'_>, (u16, serde_json::Value)> {
-    let endpoint = ctx.gateway_endpoint.as_deref().ok_or_else(|| {
+    let gateway = ctx.gateway.as_ref().ok_or_else(|| {
         (
             503,
             error_payload(
@@ -989,7 +1108,7 @@ async fn open_lookup_session(
             ),
         ));
     }
-    let client = openshell_core::grpc_client::CachedOpenShellClient::connect(endpoint)
+    let client = openshell_core::grpc_client::CachedOpenShellClient::connect(gateway)
         .await
         .map_err(|e| (502, error_payload("gateway_connect_failed", e.to_string())))?;
     client.set_workspace(workspace);