diff --git a/internal/cmd/commands/proxy/funcs.go b/internal/cmd/commands/proxy/funcs.go
index efd119f29..e447535b9 100644
--- a/internal/cmd/commands/proxy/funcs.go
+++ b/internal/cmd/commands/proxy/funcs.go
@@ -1,8 +1,6 @@
 package proxy
 
 import (
-	"time"
-
 	"github.com/hashicorp/boundary/internal/cmd/base"
 )
 
@@ -10,10 +8,9 @@ func generateConnectionInfoTableOutput(in ConnectionInfo) string {
 	var ret []string
 
 	nonAttributeMap := map[string]interface{}{
-		"Protocol":   in.Protocol,
-		"Address":    in.Address,
-		"Port":       in.Port,
-		"Expiration": in.Expiration.Local().Format(time.RFC1123),
+		"Protocol": in.Protocol,
+		"Address":  in.Address,
+		"Port":     in.Port,
 	}
 
 	maxLength := 0
diff --git a/internal/cmd/commands/proxy/proxy.go b/internal/cmd/commands/proxy/proxy.go
index f60780b5a..7ec7a1504 100644
--- a/internal/cmd/commands/proxy/proxy.go
+++ b/internal/cmd/commands/proxy/proxy.go
@@ -6,6 +6,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -14,10 +15,8 @@ import (
 	"os"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/btcsuite/btcutil/base58"
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
@@ -28,15 +27,15 @@ import (
 	"github.com/kr/pretty"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
+	"google.golang.org/protobuf/proto"
 	"nhooyr.io/websocket"
 	"nhooyr.io/websocket/wspb"
 )
 
 type ConnectionInfo struct {
-	Address    string    `json:"address"`
-	Port       int       `json:"port"`
-	Protocol   string    `json:"protocol"`
-	Expiration time.Time `json:"expiration"`
+	Address  string `json:"address"`
+	Port     int    `json:"port"`
+	Protocol string `json:"protocol"`
 }
 
 var _ cli.Command = (*Command)(nil)
@@ -53,6 +52,8 @@ type Command struct {
 	flagHostId     string
 
 	Func string
+
+	listenerCloseFunc sync.Once
 }
 
 func (c *Command) Synopsis() string {
@@ -157,7 +158,7 @@ func (c *Command) AutocompleteFlags() complete.Flags {
 	return c.Flags().Completions()
 }
 
-func (c *Command) Run(args []string) int {
+func (c *Command) Run(args []string) (retCode int) {
 	f := c.Flags()
 
 	if err := f.Parse(args); err != nil {
@@ -165,9 +166,8 @@ func (c *Command) Run(args []string) int {
 		return 1
 	}
 
-	var handshake proxy.ClientHandshake
-	var err error
-	if handshake.TofuToken, err = base62.Random(20); err != nil {
+	tofuToken, err := base62.Random(20)
+	if err != nil {
 		c.UI.Error(fmt.Errorf("Could not derive random bytes for tofu token: %w", err).Error())
 		return 1
 	}
@@ -259,6 +259,8 @@ func (c *Command) Run(args []string) int {
 		return 1
 	}
 
+	workerAddr := data.GetWorkerInfo()[0].GetAddress()
+
 	parsedCert, err := x509.ParseCertificate(data.Certificate)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Unable to decode mTLS certificate: %w", err).Error())
@@ -302,60 +304,30 @@ func (c *Command) Run(args []string) int {
 		return 1
 	}
 
-	workerAddr := data.GetWorkerInfo()[0].GetAddress()
-
-	conn, resp, err := websocket.Dial(
-		c.Context,
-		fmt.Sprintf("wss://%s/v1/proxy", workerAddr),
-		&websocket.DialOptions{
-			HTTPClient: &http.Client{
-				Transport: transport,
-			},
-			Subprotocols: []string{globals.TcpProxyV1},
-		},
-	)
-	if err != nil {
-		switch {
-		case strings.Contains(err.Error(), "tls: internal error"):
-			c.UI.Error("Session is unauthorized")
-		case strings.Contains(err.Error(), "connect: connection refused"):
-			c.UI.Error(fmt.Sprintf("Unable to connect to worker at %s", workerAddr))
-		default:
-			c.UI.Error(fmt.Errorf("Error dialing the worker: %w", err).Error())
+	listenerCloseFunc := func() {
+		if err := listener.Close(); err != nil {
+			c.UI.Error(fmt.Errorf("Error closing listener on shutdown: %w", err).Error())
+			retCode = 1
 		}
-		return 1
 	}
 
-	if resp == nil {
-		c.UI.Error("Response from worker is nil")
-		return 1
-	}
-	if resp.Header == nil {
-		c.UI.Error("Response header is nil")
-		return 1
-	}
-	negProto := resp.Header.Get("Sec-WebSocket-Protocol")
-	if negProto != globals.TcpProxyV1 {
-		c.UI.Error(fmt.Sprintf("Unexpected negotiated protocol: %s", negProto))
-		return 1
-	}
+	// Allow closing the listener from Ctrl-C
+	go func() {
+		<-c.Context.Done()
+		c.listenerCloseFunc.Do(listenerCloseFunc)
+	}()
 
-	if err := wspb.Write(c.Context, conn, &handshake); err != nil {
-		c.UI.Error(fmt.Errorf("error sending handshake to worker: %w", err).Error())
-		return 1
-	}
-	var handshakeResult proxy.HandshakeResult
-	if err := wspb.Read(c.Context, conn, &handshakeResult); err != nil {
-		c.UI.Error(fmt.Errorf("error reading handshake result: %w", err).Error())
-		return 1
-	}
+	// Ensure it runs on any other return condition
+	defer func() {
+		c.listenerCloseFunc.Do(listenerCloseFunc)
+	}()
 
 	listenerAddr := listener.Addr().(*net.TCPAddr)
+
 	connInfo := ConnectionInfo{
-		Protocol:   "tcp",
-		Address:    listenerAddr.IP.String(),
-		Port:       listenerAddr.Port,
-		Expiration: handshakeResult.GetExpiration().AsTime(),
+		Protocol: "tcp",
+		Address:  listenerAddr.IP.String(),
+		Port:     listenerAddr.Port,
 	}
 
 	switch base.Format(c.UI) {
@@ -370,53 +342,117 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(string(out))
 	}
 
+	connWg := new(sync.WaitGroup)
+	connWg.Add(1)
+
+AcceptLoop:
+	for {
+		listeningConn, err := listener.AcceptTCP()
+		if err != nil {
+			select {
+			case <-c.Context.Done():
+				connWg.Done()
+				break AcceptLoop
+			default:
+				c.UI.Error(fmt.Errorf("Error accepting connection: %w", err).Error())
+				continue
+			}
+		}
+		connWg.Add(1)
+		go func() {
+			defer listeningConn.Close()
+			if err := handleConnection(
+				c.Context,
+				connWg,
+				listeningConn,
+				workerAddr,
+				tofuToken,
+				transport); err != nil {
+				c.UI.Error(err.Error())
+			}
+		}()
+	}
+
+	connWg.Wait()
+	return 0
+}
+
+func handleConnection(
+	ctx context.Context,
+	connWg *sync.WaitGroup,
+	listeningConn *net.TCPConn,
+	workerAddr string,
+	tofuToken string,
+	transport *http.Transport) error {
+
+	defer connWg.Done()
+
+	conn, resp, err := websocket.Dial(
+		ctx,
+		fmt.Sprintf("wss://%s/v1/proxy", workerAddr),
+		&websocket.DialOptions{
+			HTTPClient: &http.Client{
+				Transport: transport,
+			},
+			Subprotocols: []string{globals.TcpProxyV1},
+		},
+	)
+	if err != nil {
+		switch {
+		case strings.Contains(err.Error(), "tls: internal error"):
+			return errors.New("Session is unauthorized")
+		case strings.Contains(err.Error(), "connect: connection refused"):
+			return fmt.Errorf("Unable to connect to worker at %s", workerAddr)
+		default:
+			return fmt.Errorf("Error dialing the worker: %w", err)
+		}
+	}
+
+	if resp == nil {
+		return errors.New("Response from worker is nil")
+	}
+	if resp.Header == nil {
+		return errors.New("Response header is nil")
+	}
+	negProto := resp.Header.Get("Sec-WebSocket-Protocol")
+	if negProto != globals.TcpProxyV1 {
+		return fmt.Errorf("Unexpected negotiated protocol: %s", negProto)
+	}
+
+	handshake := proxy.ClientHandshake{TofuToken: tofuToken}
+	if err := wspb.Write(ctx, conn, &handshake); err != nil {
+		return fmt.Errorf("error sending handshake to worker: %w", err)
+	}
+	var handshakeResult proxy.HandshakeResult
+	if err := wspb.Read(ctx, conn, &handshakeResult); err != nil {
+		return fmt.Errorf("error reading handshake result: %w", err)
+	}
+
 	// We don't _rely_ on client-side timeout verification but this prevents us
 	// seeming to be ready for a connection that will immediately fail when we
 	// try to actually make it
-	expiringCtx, cancel := context.WithDeadline(c.Context, handshakeResult.GetExpiration().AsTime())
+	expiringCtx, cancel := context.WithDeadline(ctx, handshakeResult.GetExpiration().AsTime())
 	defer cancel()
 
 	// Get a wrapped net.Conn so we can use io.Copy
 	netConn := websocket.NetConn(expiringCtx, conn, websocket.MessageBinary)
 
-	// Allow closing the listener from Ctrl-C
-	go func() {
-		<-expiringCtx.Done()
-		listener.Close()
-	}()
+	localWg := new(sync.WaitGroup)
+	localWg.Add(2)
 
-	listeningConn, err := listener.AcceptTCP()
-	listener.Close()
-	if err != nil {
-		select {
-		case <-expiringCtx.Done():
-			return 0
-		default:
-			c.UI.Error(fmt.Errorf("Error accepting connection: %w", err).Error())
-			return 1
-		}
-	}
-
-	connWg := new(sync.WaitGroup)
-	connWg.Add(2)
 	go func() {
-		defer connWg.Done()
-		_, err := io.Copy(netConn, listeningConn)
-		if c.flagVerbose {
-			c.UI.Info(fmt.Sprintf("copy from client to endpoint done, error: %v", err))
-		}
+		defer localWg.Done()
+		io.Copy(netConn, listeningConn)
 		netConn.Close()
 		listeningConn.Close()
 	}()
 	go func() {
-		defer connWg.Done()
-		_, err := io.Copy(listeningConn, netConn)
-		if c.flagVerbose {
-			c.UI.Info(fmt.Sprintf("copy from endpoint to client done, error: %v", err))
-		}
+		defer localWg.Done()
+		io.Copy(listeningConn, netConn)
 		listeningConn.Close()
 		netConn.Close()
 	}()
-	connWg.Wait()
-	return 0
+	localWg.Wait()
+
+	return nil
 }
diff --git a/internal/gen/controller/servers/services/server_coordination_service.pb.go b/internal/gen/controller/servers/services/server_coordination_service.pb.go
index 8131311a4..b7340611f 100644
--- a/internal/gen/controller/servers/services/server_coordination_service.pb.go
+++ b/internal/gen/controller/servers/services/server_coordination_service.pb.go
@@ -31,157 +31,218 @@ const (
 // of the legacy proto package is being used.
 const _ = proto.ProtoPackageIsVersion4
 
-type Job_JOBTYPE int32
+type CONNECTIONSTATUS int32
 
 const (
-	Job_JOBTYPE_UNSPECIFIED Job_JOBTYPE = 0
-	Job_JOBTYPE_SESSION     Job_JOBTYPE = 1
+	CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED CONNECTIONSTATUS = 0
+	CONNECTIONSTATUS_CONNECTIONSTATUS_AUTHORIZED  CONNECTIONSTATUS = 1
+	CONNECTIONSTATUS_CONNECTIONSTATUS_CONNECTED   CONNECTIONSTATUS = 2
+	CONNECTIONSTATUS_CONNECTIONSTATUS_CLOSED      CONNECTIONSTATUS = 3
 )
 
-// Enum value maps for Job_JOBTYPE.
+// Enum value maps for CONNECTIONSTATUS.
 var (
-	Job_JOBTYPE_name = map[int32]string{
+	CONNECTIONSTATUS_name = map[int32]string{
+		0: "CONNECTIONSTATUS_UNSPECIFIED",
+		1: "CONNECTIONSTATUS_AUTHORIZED",
+		2: "CONNECTIONSTATUS_CONNECTED",
+		3: "CONNECTIONSTATUS_CLOSED",
+	}
+	CONNECTIONSTATUS_value = map[string]int32{
+		"CONNECTIONSTATUS_UNSPECIFIED": 0,
+		"CONNECTIONSTATUS_AUTHORIZED":  1,
+		"CONNECTIONSTATUS_CONNECTED":   2,
+		"CONNECTIONSTATUS_CLOSED":      3,
+	}
+)
+
+func (x CONNECTIONSTATUS) Enum() *CONNECTIONSTATUS {
+	p := new(CONNECTIONSTATUS)
+	*p = x
+	return p
+}
+
+func (x CONNECTIONSTATUS) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CONNECTIONSTATUS) Descriptor() protoreflect.EnumDescriptor {
+	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[0].Descriptor()
+}
+
+func (CONNECTIONSTATUS) Type() protoreflect.EnumType {
+	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[0]
+}
+
+func (x CONNECTIONSTATUS) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CONNECTIONSTATUS.Descriptor instead.
+func (CONNECTIONSTATUS) EnumDescriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{0}
+}
+
+type SESSIONSTATUS int32
+
+const (
+	SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED SESSIONSTATUS = 0
+	SESSIONSTATUS_SESSIONSTATUS_PENDING     SESSIONSTATUS = 1
+	SESSIONSTATUS_SESSIONSTATUS_ACTIVE      SESSIONSTATUS = 2
+	SESSIONSTATUS_SESSIONSTATUS_CANCELLING  SESSIONSTATUS = 3
+	SESSIONSTATUS_SESSIONSTATUS_TERMINATED  SESSIONSTATUS = 4
+)
+
+// Enum value maps for SESSIONSTATUS.
+var (
+	SESSIONSTATUS_name = map[int32]string{
+		0: "SESSIONSTATUS_UNSPECIFIED",
+		1: "SESSIONSTATUS_PENDING",
+		2: "SESSIONSTATUS_ACTIVE",
+		3: "SESSIONSTATUS_CANCELLING",
+		4: "SESSIONSTATUS_TERMINATED",
+	}
+	SESSIONSTATUS_value = map[string]int32{
+		"SESSIONSTATUS_UNSPECIFIED": 0,
+		"SESSIONSTATUS_PENDING":     1,
+		"SESSIONSTATUS_ACTIVE":      2,
+		"SESSIONSTATUS_CANCELLING":  3,
+		"SESSIONSTATUS_TERMINATED":  4,
+	}
+)
+
+func (x SESSIONSTATUS) Enum() *SESSIONSTATUS {
+	p := new(SESSIONSTATUS)
+	*p = x
+	return p
+}
+
+func (x SESSIONSTATUS) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SESSIONSTATUS) Descriptor() protoreflect.EnumDescriptor {
+	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[1].Descriptor()
+}
+
+func (SESSIONSTATUS) Type() protoreflect.EnumType {
+	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[1]
+}
+
+func (x SESSIONSTATUS) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SESSIONSTATUS.Descriptor instead.
+func (SESSIONSTATUS) EnumDescriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{1}
+}
+
+type JOBTYPE int32
+
+const (
+	JOBTYPE_JOBTYPE_UNSPECIFIED JOBTYPE = 0
+	JOBTYPE_JOBTYPE_SESSION     JOBTYPE = 1
+)
+
+// Enum value maps for JOBTYPE.
+var (
+	JOBTYPE_name = map[int32]string{
 		0: "JOBTYPE_UNSPECIFIED",
 		1: "JOBTYPE_SESSION",
 	}
-	Job_JOBTYPE_value = map[string]int32{
+	JOBTYPE_value = map[string]int32{
 		"JOBTYPE_UNSPECIFIED": 0,
 		"JOBTYPE_SESSION":     1,
 	}
 )
 
-func (x Job_JOBTYPE) Enum() *Job_JOBTYPE {
-	p := new(Job_JOBTYPE)
+func (x JOBTYPE) Enum() *JOBTYPE {
+	p := new(JOBTYPE)
 	*p = x
 	return p
 }
 
-func (x Job_JOBTYPE) String() string {
+func (x JOBTYPE) String() string {
 	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
 }
 
-func (Job_JOBTYPE) Descriptor() protoreflect.EnumDescriptor {
-	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[0].Descriptor()
-}
-
-func (Job_JOBTYPE) Type() protoreflect.EnumType {
-	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[0]
-}
-
-func (x Job_JOBTYPE) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use Job_JOBTYPE.Descriptor instead.
-func (Job_JOBTYPE) EnumDescriptor() ([]byte, []int) {
-	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{2, 0}
-}
-
-type JobStatus_STATUS int32
-
-const (
-	// TODO: Get a better picture of what states general jobs can be in.
-	JobStatus_STATUS_UNSPECIFIED JobStatus_STATUS = 0
-	// Specifies that the job is actively being handled by the worker.
-	JobStatus_STATUS_ACTIVE    JobStatus_STATUS = 1
-	JobStatus_STATUS_CANCELLED JobStatus_STATUS = 2
-	JobStatus_STATUS_COMPLETED JobStatus_STATUS = 3
-)
-
-// Enum value maps for JobStatus_STATUS.
-var (
-	JobStatus_STATUS_name = map[int32]string{
-		0: "STATUS_UNSPECIFIED",
-		1: "STATUS_ACTIVE",
-		2: "STATUS_CANCELLED",
-		3: "STATUS_COMPLETED",
-	}
-	JobStatus_STATUS_value = map[string]int32{
-		"STATUS_UNSPECIFIED": 0,
-		"STATUS_ACTIVE":      1,
-		"STATUS_CANCELLED":   2,
-		"STATUS_COMPLETED":   3,
-	}
-)
-
-func (x JobStatus_STATUS) Enum() *JobStatus_STATUS {
-	p := new(JobStatus_STATUS)
-	*p = x
-	return p
-}
-
-func (x JobStatus_STATUS) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (JobStatus_STATUS) Descriptor() protoreflect.EnumDescriptor {
-	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[1].Descriptor()
-}
-
-func (JobStatus_STATUS) Type() protoreflect.EnumType {
-	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[1]
-}
-
-func (x JobStatus_STATUS) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use JobStatus_STATUS.Descriptor instead.
-func (JobStatus_STATUS) EnumDescriptor() ([]byte, []int) {
-	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{3, 0}
-}
-
-type JobChangeRequest_CHANGETYPE int32
-
-const (
-	JobChangeRequest_CHANGETYPE_UNSPECIFIED JobChangeRequest_CHANGETYPE = 0
-	// Indicates that the job should be cancelled on the worker.
-	JobChangeRequest_CHANGETYPE_CANCEL JobChangeRequest_CHANGETYPE = 1
-)
-
-// Enum value maps for JobChangeRequest_CHANGETYPE.
-var (
-	JobChangeRequest_CHANGETYPE_name = map[int32]string{
-		0: "CHANGETYPE_UNSPECIFIED",
-		1: "CHANGETYPE_CANCEL",
-	}
-	JobChangeRequest_CHANGETYPE_value = map[string]int32{
-		"CHANGETYPE_UNSPECIFIED": 0,
-		"CHANGETYPE_CANCEL":      1,
-	}
-)
-
-func (x JobChangeRequest_CHANGETYPE) Enum() *JobChangeRequest_CHANGETYPE {
-	p := new(JobChangeRequest_CHANGETYPE)
-	*p = x
-	return p
-}
-
-func (x JobChangeRequest_CHANGETYPE) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (JobChangeRequest_CHANGETYPE) Descriptor() protoreflect.EnumDescriptor {
+func (JOBTYPE) Descriptor() protoreflect.EnumDescriptor {
 	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[2].Descriptor()
 }
 
-func (JobChangeRequest_CHANGETYPE) Type() protoreflect.EnumType {
+func (JOBTYPE) Type() protoreflect.EnumType {
 	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[2]
 }
 
-func (x JobChangeRequest_CHANGETYPE) Number() protoreflect.EnumNumber {
+func (x JOBTYPE) Number() protoreflect.EnumNumber {
 	return protoreflect.EnumNumber(x)
 }
 
-// Deprecated: Use JobChangeRequest_CHANGETYPE.Descriptor instead.
-func (JobChangeRequest_CHANGETYPE) EnumDescriptor() ([]byte, []int) {
-	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{5, 0}
+// Deprecated: Use JOBTYPE.Descriptor instead.
+func (JOBTYPE) EnumDescriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{2}
+}
+
+type CHANGETYPE int32
+
+const (
+	CHANGETYPE_CHANGETYPE_UNSPECIFIED CHANGETYPE = 0
+	// Indicates that the job should be cancelled on the worker; will also update
+	// the state on the worker.
+	CHANGETYPE_CHANGETYPE_CANCEL CHANGETYPE = 1
+	// Indicates to the worker to simply update its knowledge of the state.
+	CHANGETYPE_CHANGETYPE_UPDATE_STATE CHANGETYPE = 2
+)
+
+// Enum value maps for CHANGETYPE.
+var (
+	CHANGETYPE_name = map[int32]string{
+		0: "CHANGETYPE_UNSPECIFIED",
+		1: "CHANGETYPE_CANCEL",
+		2: "CHANGETYPE_UPDATE_STATE",
+	}
+	CHANGETYPE_value = map[string]int32{
+		"CHANGETYPE_UNSPECIFIED":  0,
+		"CHANGETYPE_CANCEL":       1,
+		"CHANGETYPE_UPDATE_STATE": 2,
+	}
+)
+
+func (x CHANGETYPE) Enum() *CHANGETYPE {
+	p := new(CHANGETYPE)
+	*p = x
+	return p
+}
+
+func (x CHANGETYPE) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CHANGETYPE) Descriptor() protoreflect.EnumDescriptor {
+	return file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[3].Descriptor()
+}
+
+func (CHANGETYPE) Type() protoreflect.EnumType {
+	return &file_controller_servers_services_v1_server_coordination_service_proto_enumTypes[3]
+}
+
+func (x CHANGETYPE) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CHANGETYPE.Descriptor instead.
+func (CHANGETYPE) EnumDescriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{3}
 }
 
 type Connection struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	ConnectionId string           `protobuf:"bytes,1,opt,name=connection_id,json=connectionId,proto3" json:"connection_id,omitempty"`
+	Status       CONNECTIONSTATUS `protobuf:"varint,2,opt,name=status,proto3,enum=controller.servers.services.v1.CONNECTIONSTATUS" json:"status,omitempty"`
 }
 
 func (x *Connection) Reset() {
@@ -216,12 +277,28 @@ func (*Connection) Descriptor() ([]byte, []int) {
 	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{0}
 }
 
+func (x *Connection) GetConnectionId() string {
+	if x != nil {
+		return x.ConnectionId
+	}
+	return ""
+}
+
+func (x *Connection) GetStatus() CONNECTIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED
+}
+
 type SessionJobInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Connections []*Connection `protobuf:"bytes,1,rep,name=connections,proto3" json:"connections,omitempty"`
+	SessionId   string        `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	Status      SESSIONSTATUS `protobuf:"varint,2,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
+	Connections []*Connection `protobuf:"bytes,3,rep,name=connections,proto3" json:"connections,omitempty"`
 }
 
 func (x *SessionJobInfo) Reset() {
@@ -256,6 +333,20 @@ func (*SessionJobInfo) Descriptor() ([]byte, []int) {
 	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{1}
 }
 
+func (x *SessionJobInfo) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *SessionJobInfo) GetStatus() SESSIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED
+}
+
 func (x *SessionJobInfo) GetConnections() []*Connection {
 	if x != nil {
 		return x.Connections
@@ -268,8 +359,7 @@ type Job struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	JobId string      `protobuf:"bytes,1,opt,name=job_id,json=jobId,proto3" json:"job_id,omitempty"`
-	Type  Job_JOBTYPE `protobuf:"varint,2,opt,name=type,proto3,enum=controller.servers.services.v1.Job_JOBTYPE" json:"type,omitempty"`
+	Type JOBTYPE `protobuf:"varint,1,opt,name=type,proto3,enum=controller.servers.services.v1.JOBTYPE" json:"type,omitempty"`
 	// Types that are assignable to JobInfo:
 	//	*Job_SessionInfo
 	JobInfo isJob_JobInfo `protobuf_oneof:"job_info"`
@@ -307,18 +397,11 @@ func (*Job) Descriptor() ([]byte, []int) {
 	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *Job) GetJobId() string {
-	if x != nil {
-		return x.JobId
-	}
-	return ""
-}
-
-func (x *Job) GetType() Job_JOBTYPE {
+func (x *Job) GetType() JOBTYPE {
 	if x != nil {
 		return x.Type
 	}
-	return Job_JOBTYPE_UNSPECIFIED
+	return JOBTYPE_JOBTYPE_UNSPECIFIED
 }
 
 func (m *Job) GetJobInfo() isJob_JobInfo {
@@ -341,7 +424,7 @@ type isJob_JobInfo interface {
 
 type Job_SessionInfo struct {
 	// This value is specified when type is JOBTYPE_SESSION.
-	SessionInfo *SessionJobInfo `protobuf:"bytes,3,opt,name=session_info,json=sessionInfo,proto3,oneof"`
+	SessionInfo *SessionJobInfo `protobuf:"bytes,2,opt,name=session_info,json=sessionInfo,proto3,oneof"`
 }
 
 func (*Job_SessionInfo) isJob_JobInfo() {}
@@ -351,8 +434,7 @@ type JobStatus struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Job    *Job             `protobuf:"bytes,1,opt,name=job,proto3" json:"job,omitempty"`
-	Status JobStatus_STATUS `protobuf:"varint,3,opt,name=status,proto3,enum=controller.servers.services.v1.JobStatus_STATUS" json:"status,omitempty"`
+	Job *Job `protobuf:"bytes,1,opt,name=job,proto3" json:"job,omitempty"`
 }
 
 func (x *JobStatus) Reset() {
@@ -394,20 +476,13 @@ func (x *JobStatus) GetJob() *Job {
 	return nil
 }
 
-func (x *JobStatus) GetStatus() JobStatus_STATUS {
-	if x != nil {
-		return x.Status
-	}
-	return JobStatus_STATUS_UNSPECIFIED
-}
-
 type StatusRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// The worker info. We could use information from the TLS connection but this
-	// is easier and going the other route doesn't provide much benefit -- if you
+	// is easier and going the other route doesn't provijde much benefit -- if you
 	// get access to the key and spoof the connection, you're already compromised.
 	Worker *servers.Server `protobuf:"bytes,10,opt,name=worker,proto3" json:"worker,omitempty"`
 	// Jobs which this worker wants to report the status.
@@ -465,8 +540,8 @@ type JobChangeRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Job         *Job                        `protobuf:"bytes,1,opt,name=job,proto3" json:"job,omitempty"`
-	RequestType JobChangeRequest_CHANGETYPE `protobuf:"varint,2,opt,name=request_type,json=requestType,proto3,enum=controller.servers.services.v1.JobChangeRequest_CHANGETYPE" json:"request_type,omitempty"`
+	Job         *Job       `protobuf:"bytes,1,opt,name=job,proto3" json:"job,omitempty"`
+	RequestType CHANGETYPE `protobuf:"varint,2,opt,name=request_type,json=requestType,proto3,enum=controller.servers.services.v1.CHANGETYPE" json:"request_type,omitempty"`
 }
 
 func (x *JobChangeRequest) Reset() {
@@ -508,11 +583,11 @@ func (x *JobChangeRequest) GetJob() *Job {
 	return nil
 }
 
-func (x *JobChangeRequest) GetRequestType() JobChangeRequest_CHANGETYPE {
+func (x *JobChangeRequest) GetRequestType() CHANGETYPE {
 	if x != nil {
 		return x.RequestType
 	}
-	return JobChangeRequest_CHANGETYPE_UNSPECIFIED
+	return CHANGETYPE_CHANGETYPE_UNSPECIFIED
 }
 
 type StatusResponse struct {
@@ -589,93 +664,114 @@ var file_controller_servers_services_v1_server_coordination_service_proto_rawDes
 	0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x1a, 0x23, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f,
 	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x0c, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x5e, 0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x4a, 0x6f, 0x62, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x4c, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xf7, 0x01, 0x0a, 0x03, 0x4a, 0x6f, 0x62, 0x12, 0x15,
-	0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x3f, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
+	0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x7b, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x48, 0x0a, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x4f, 0x4e,
+	0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xc4, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x4a, 0x6f, 0x62, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x45, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x4c,
+	0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
 	0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x2e, 0x4a, 0x4f, 0x42, 0x54, 0x59, 0x50, 0x45,
-	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x53, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x63,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa3, 0x01, 0x0a,
+	0x03, 0x4a, 0x6f, 0x62, 0x12, 0x3b, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x27, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x4f, 0x42, 0x54, 0x59, 0x50, 0x45, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x53, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x6e, 0x66,
+	0x6f, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x4a, 0x6f, 0x62, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x0b, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x42, 0x0a, 0x0a, 0x08, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x6e,
+	0x66, 0x6f, 0x22, 0x42, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x35, 0x0a, 0x03, 0x6a, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x63,
 	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x0b,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x22, 0x37, 0x0a, 0x07, 0x4a,
+	0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f,
+	0x62, 0x52, 0x03, 0x6a, 0x6f, 0x62, 0x22, 0x85, 0x01, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x06, 0x77, 0x6f, 0x72, 0x6b,
+	0x65, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x06, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x12,
+	0x3d, 0x0a, 0x04, 0x6a, 0x6f, 0x62, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a,
+	0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x04, 0x6a, 0x6f, 0x62, 0x73, 0x22, 0x98,
+	0x01, 0x0a, 0x10, 0x4a, 0x6f, 0x62, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x03, 0x6a, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x23, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x52, 0x03, 0x6a, 0x6f, 0x62, 0x12, 0x4d, 0x0a, 0x0c, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54, 0x59, 0x50, 0x45, 0x52, 0x0b, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x54, 0x79, 0x70, 0x65, 0x22, 0xa8, 0x01, 0x0a, 0x0e, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0b,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x73, 0x12, 0x55, 0x0a,
+	0x0d, 0x6a, 0x6f, 0x62, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x14,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0c, 0x6a, 0x6f, 0x62, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x73, 0x2a, 0x92, 0x01, 0x0a, 0x10, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54,
+	0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x12, 0x20, 0x0a, 0x1c, 0x43, 0x4f, 0x4e,
+	0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e,
+	0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1f, 0x0a, 0x1b, 0x43,
+	0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
+	0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x5a, 0x45, 0x44, 0x10, 0x01, 0x12, 0x1e, 0x0a, 0x1a,
+	0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x1b, 0x0a, 0x17,
+	0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x03, 0x2a, 0x9f, 0x01, 0x0a, 0x0d, 0x53, 0x45,
+	0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x12, 0x1d, 0x0a, 0x19, 0x53,
+	0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x53, 0x45,
+	0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x45, 0x4e, 0x44,
+	0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x02, 0x12,
+	0x1c, 0x0a, 0x18, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x43, 0x41, 0x4e, 0x43, 0x45, 0x4c, 0x4c, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x1c, 0x0a,
+	0x18, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54,
+	0x45, 0x52, 0x4d, 0x49, 0x4e, 0x41, 0x54, 0x45, 0x44, 0x10, 0x04, 0x2a, 0x37, 0x0a, 0x07, 0x4a,
 	0x4f, 0x42, 0x54, 0x59, 0x50, 0x45, 0x12, 0x17, 0x0a, 0x13, 0x4a, 0x4f, 0x42, 0x54, 0x59, 0x50,
 	0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
 	0x13, 0x0a, 0x0f, 0x4a, 0x4f, 0x42, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49,
-	0x4f, 0x4e, 0x10, 0x01, 0x42, 0x0a, 0x0a, 0x08, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x6e, 0x66, 0x6f,
-	0x22, 0xed, 0x01, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x35,
-	0x0a, 0x03, 0x6a, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
-	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62,
-	0x52, 0x03, 0x6a, 0x6f, 0x62, 0x12, 0x48, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x2e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22,
-	0x5f, 0x0a, 0x06, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x12, 0x16, 0x0a, 0x12, 0x53, 0x54, 0x41,
-	0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
-	0x00, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49,
-	0x56, 0x45, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43,
-	0x41, 0x4e, 0x43, 0x45, 0x4c, 0x4c, 0x45, 0x44, 0x10, 0x02, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x54,
-	0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x4c, 0x45, 0x54, 0x45, 0x44, 0x10, 0x03,
-	0x22, 0x85, 0x01, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x35, 0x0a, 0x06, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x52, 0x06, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x04, 0x6a, 0x6f, 0x62,
-	0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x52, 0x04, 0x6a, 0x6f, 0x62, 0x73, 0x22, 0xea, 0x01, 0x0a, 0x10, 0x4a, 0x6f, 0x62,
-	0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x35, 0x0a,
-	0x03, 0x6a, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x52,
-	0x03, 0x6a, 0x6f, 0x62, 0x12, 0x5e, 0x0a, 0x0c, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
-	0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x3b, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x43,
-	0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x43, 0x48, 0x41,
-	0x4e, 0x47, 0x45, 0x54, 0x59, 0x50, 0x45, 0x52, 0x0b, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x54, 0x79, 0x70, 0x65, 0x22, 0x3f, 0x0a, 0x0a, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54, 0x59,
+	0x4f, 0x4e, 0x10, 0x01, 0x2a, 0x5c, 0x0a, 0x0a, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54, 0x59,
 	0x50, 0x45, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54, 0x59, 0x50, 0x45,
 	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x15,
 	0x0a, 0x11, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x41, 0x4e,
-	0x43, 0x45, 0x4c, 0x10, 0x01, 0x22, 0xa8, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x74,
-	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x73, 0x12, 0x55, 0x0a, 0x0d, 0x6a, 0x6f, 0x62,
-	0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
-	0x31, 0x2e, 0x4a, 0x6f, 0x62, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x52, 0x0c, 0x6a, 0x6f, 0x62, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73,
-	0x32, 0x86, 0x01, 0x0a, 0x19, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6f, 0x72, 0x64,
-	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x69,
-	0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x43, 0x45, 0x4c, 0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x45,
+	0x10, 0x02, 0x32, 0x86, 0x01, 0x0a, 0x19, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6f,
+	0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x69, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x51, 0x5a, 0x4f, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2f, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -690,40 +786,42 @@ func file_controller_servers_services_v1_server_coordination_service_proto_rawDe
 	return file_controller_servers_services_v1_server_coordination_service_proto_rawDescData
 }
 
-var file_controller_servers_services_v1_server_coordination_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_controller_servers_services_v1_server_coordination_service_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
 var file_controller_servers_services_v1_server_coordination_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
 var file_controller_servers_services_v1_server_coordination_service_proto_goTypes = []interface{}{
-	(Job_JOBTYPE)(0),                 // 0: controller.servers.services.v1.Job.JOBTYPE
-	(JobStatus_STATUS)(0),            // 1: controller.servers.services.v1.JobStatus.STATUS
-	(JobChangeRequest_CHANGETYPE)(0), // 2: controller.servers.services.v1.JobChangeRequest.CHANGETYPE
-	(*Connection)(nil),               // 3: controller.servers.services.v1.Connection
-	(*SessionJobInfo)(nil),           // 4: controller.servers.services.v1.SessionJobInfo
-	(*Job)(nil),                      // 5: controller.servers.services.v1.Job
-	(*JobStatus)(nil),                // 6: controller.servers.services.v1.JobStatus
-	(*StatusRequest)(nil),            // 7: controller.servers.services.v1.StatusRequest
-	(*JobChangeRequest)(nil),         // 8: controller.servers.services.v1.JobChangeRequest
-	(*StatusResponse)(nil),           // 9: controller.servers.services.v1.StatusResponse
-	(*servers.Server)(nil),           // 10: controller.servers.v1.Server
+	(CONNECTIONSTATUS)(0),    // 0: controller.servers.services.v1.CONNECTIONSTATUS
+	(SESSIONSTATUS)(0),       // 1: controller.servers.services.v1.SESSIONSTATUS
+	(JOBTYPE)(0),             // 2: controller.servers.services.v1.JOBTYPE
+	(CHANGETYPE)(0),          // 3: controller.servers.services.v1.CHANGETYPE
+	(*Connection)(nil),       // 4: controller.servers.services.v1.Connection
+	(*SessionJobInfo)(nil),   // 5: controller.servers.services.v1.SessionJobInfo
+	(*Job)(nil),              // 6: controller.servers.services.v1.Job
+	(*JobStatus)(nil),        // 7: controller.servers.services.v1.JobStatus
+	(*StatusRequest)(nil),    // 8: controller.servers.services.v1.StatusRequest
+	(*JobChangeRequest)(nil), // 9: controller.servers.services.v1.JobChangeRequest
+	(*StatusResponse)(nil),   // 10: controller.servers.services.v1.StatusResponse
+	(*servers.Server)(nil),   // 11: controller.servers.v1.Server
 }
 var file_controller_servers_services_v1_server_coordination_service_proto_depIdxs = []int32{
-	3,  // 0: controller.servers.services.v1.SessionJobInfo.connections:type_name -> controller.servers.services.v1.Connection
-	0,  // 1: controller.servers.services.v1.Job.type:type_name -> controller.servers.services.v1.Job.JOBTYPE
-	4,  // 2: controller.servers.services.v1.Job.session_info:type_name -> controller.servers.services.v1.SessionJobInfo
-	5,  // 3: controller.servers.services.v1.JobStatus.job:type_name -> controller.servers.services.v1.Job
-	1,  // 4: controller.servers.services.v1.JobStatus.status:type_name -> controller.servers.services.v1.JobStatus.STATUS
-	10, // 5: controller.servers.services.v1.StatusRequest.worker:type_name -> controller.servers.v1.Server
-	6,  // 6: controller.servers.services.v1.StatusRequest.jobs:type_name -> controller.servers.services.v1.JobStatus
-	5,  // 7: controller.servers.services.v1.JobChangeRequest.job:type_name -> controller.servers.services.v1.Job
-	2,  // 8: controller.servers.services.v1.JobChangeRequest.request_type:type_name -> controller.servers.services.v1.JobChangeRequest.CHANGETYPE
-	10, // 9: controller.servers.services.v1.StatusResponse.controllers:type_name -> controller.servers.v1.Server
-	8,  // 10: controller.servers.services.v1.StatusResponse.jobs_requests:type_name -> controller.servers.services.v1.JobChangeRequest
-	7,  // 11: controller.servers.services.v1.ServerCoordinationService.Status:input_type -> controller.servers.services.v1.StatusRequest
-	9,  // 12: controller.servers.services.v1.ServerCoordinationService.Status:output_type -> controller.servers.services.v1.StatusResponse
-	12, // [12:13] is the sub-list for method output_type
-	11, // [11:12] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	0,  // 0: controller.servers.services.v1.Connection.status:type_name -> controller.servers.services.v1.CONNECTIONSTATUS
+	1,  // 1: controller.servers.services.v1.SessionJobInfo.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	4,  // 2: controller.servers.services.v1.SessionJobInfo.connections:type_name -> controller.servers.services.v1.Connection
+	2,  // 3: controller.servers.services.v1.Job.type:type_name -> controller.servers.services.v1.JOBTYPE
+	5,  // 4: controller.servers.services.v1.Job.session_info:type_name -> controller.servers.services.v1.SessionJobInfo
+	6,  // 5: controller.servers.services.v1.JobStatus.job:type_name -> controller.servers.services.v1.Job
+	11, // 6: controller.servers.services.v1.StatusRequest.worker:type_name -> controller.servers.v1.Server
+	7,  // 7: controller.servers.services.v1.StatusRequest.jobs:type_name -> controller.servers.services.v1.JobStatus
+	6,  // 8: controller.servers.services.v1.JobChangeRequest.job:type_name -> controller.servers.services.v1.Job
+	3,  // 9: controller.servers.services.v1.JobChangeRequest.request_type:type_name -> controller.servers.services.v1.CHANGETYPE
+	11, // 10: controller.servers.services.v1.StatusResponse.controllers:type_name -> controller.servers.v1.Server
+	9,  // 11: controller.servers.services.v1.StatusResponse.jobs_requests:type_name -> controller.servers.services.v1.JobChangeRequest
+	8,  // 12: controller.servers.services.v1.ServerCoordinationService.Status:input_type -> controller.servers.services.v1.StatusRequest
+	10, // 13: controller.servers.services.v1.ServerCoordinationService.Status:output_type -> controller.servers.services.v1.StatusResponse
+	13, // [13:14] is the sub-list for method output_type
+	12, // [12:13] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_controller_servers_services_v1_server_coordination_service_proto_init() }
@@ -825,7 +923,7 @@ func file_controller_servers_services_v1_server_coordination_service_proto_init(
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_servers_services_v1_server_coordination_service_proto_rawDesc,
-			NumEnums:      3,
+			NumEnums:      4,
 			NumMessages:   7,
 			NumExtensions: 0,
 			NumServices:   1,
diff --git a/internal/gen/controller/servers/services/session_service.pb.go b/internal/gen/controller/servers/services/session_service.pb.go
index a57e8b8bf..1cb14751b 100644
--- a/internal/gen/controller/servers/services/session_service.pb.go
+++ b/internal/gen/controller/servers/services/session_service.pb.go
@@ -92,6 +92,7 @@ type LookupSessionResponse struct {
 	Version       uint32                            `protobuf:"varint,30,opt,name=version,proto3" json:"version,omitempty"`
 	Endpoint      string                            `protobuf:"bytes,40,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
 	Expiration    *timestamp.Timestamp              `protobuf:"bytes,50,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	Status        SESSIONSTATUS                     `protobuf:"varint,60,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
 }
 
 func (x *LookupSessionResponse) Reset() {
@@ -161,15 +162,23 @@ func (x *LookupSessionResponse) GetExpiration() *timestamp.Timestamp {
 	return nil
 }
 
+func (x *LookupSessionResponse) GetStatus() SESSIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED
+}
+
 type ActivateSessionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	SessionId string `protobuf:"bytes,10,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
-	TofuToken string `protobuf:"bytes,20,opt,name=tofu_token,json=tofuToken,proto3" json:"tofu_token,omitempty"`
-	Version   uint32 `protobuf:"varint,30,opt,name=version,proto3" json:"version,omitempty"`
-	WorkerId  string `protobuf:"bytes,40,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty"`
+	SessionId string        `protobuf:"bytes,10,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	TofuToken string        `protobuf:"bytes,20,opt,name=tofu_token,json=tofuToken,proto3" json:"tofu_token,omitempty"`
+	Version   uint32        `protobuf:"varint,30,opt,name=version,proto3" json:"version,omitempty"`
+	WorkerId  string        `protobuf:"bytes,40,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty"`
+	Status    SESSIONSTATUS `protobuf:"varint,50,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
 }
 
 func (x *ActivateSessionRequest) Reset() {
@@ -232,10 +241,20 @@ func (x *ActivateSessionRequest) GetWorkerId() string {
 	return ""
 }
 
+func (x *ActivateSessionRequest) GetStatus() SESSIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED
+}
+
 type ActivateSessionResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	SessionId string        `protobuf:"bytes,10,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	Status    SESSIONSTATUS `protobuf:"varint,20,opt,name=status,proto3,enum=controller.servers.services.v1.SESSIONSTATUS" json:"status,omitempty"`
 }
 
 func (x *ActivateSessionResponse) Reset() {
@@ -270,6 +289,122 @@ func (*ActivateSessionResponse) Descriptor() ([]byte, []int) {
 	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{3}
 }
 
+func (x *ActivateSessionResponse) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *ActivateSessionResponse) GetStatus() SESSIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED
+}
+
+type AuthorizeConnectionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SessionId string `protobuf:"bytes,10,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+}
+
+func (x *AuthorizeConnectionRequest) Reset() {
+	*x = AuthorizeConnectionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeConnectionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeConnectionRequest) ProtoMessage() {}
+
+func (x *AuthorizeConnectionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeConnectionRequest.ProtoReflect.Descriptor instead.
+func (*AuthorizeConnectionRequest) Descriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *AuthorizeConnectionRequest) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+type AuthorizeConnectionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ConnectionId string           `protobuf:"bytes,10,opt,name=connection_id,json=connectionId,proto3" json:"connection_id,omitempty"`
+	Status       CONNECTIONSTATUS `protobuf:"varint,20,opt,name=status,proto3,enum=controller.servers.services.v1.CONNECTIONSTATUS" json:"status,omitempty"`
+}
+
+func (x *AuthorizeConnectionResponse) Reset() {
+	*x = AuthorizeConnectionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeConnectionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeConnectionResponse) ProtoMessage() {}
+
+func (x *AuthorizeConnectionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_servers_services_v1_session_service_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeConnectionResponse.ProtoReflect.Descriptor instead.
+func (*AuthorizeConnectionResponse) Descriptor() ([]byte, []int) {
+	return file_controller_servers_services_v1_session_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *AuthorizeConnectionResponse) GetConnectionId() string {
+	if x != nil {
+		return x.ConnectionId
+	}
+	return ""
+}
+
+func (x *AuthorizeConnectionResponse) GetStatus() CONNECTIONSTATUS {
+	if x != nil {
+		return x.Status
+	}
+	return CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED
+}
+
 var File_controller_servers_services_v1_session_service_proto protoreflect.FileDescriptor
 
 var file_controller_servers_services_v1_session_service_proto_rawDesc = []byte{
@@ -285,62 +420,103 @@ var file_controller_servers_services_v1_session_service_proto_rawDesc = []byte{
 	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x30, 0x63, 0x6f,
 	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73,
 	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2f, 0x76,
-	0x31, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x35,
-	0x0a, 0x14, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x8d, 0x02, 0x0a, 0x15, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70,
-	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x63, 0x0a, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x66, 0x75, 0x5f, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f, 0x66, 0x75, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x1e,
-	0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a,
-	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70,
-	0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x8d, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x31, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x40,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0x35, 0x0a, 0x14, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0xd4, 0x02, 0x0a, 0x15, 0x4c, 0x6f, 0x6f, 0x6b,
+	0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x63, 0x0a, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x66, 0x75, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f, 0x66, 0x75,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x1e, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x28, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x3a, 0x0a, 0x0a, 0x65,
+	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70,
+	0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x45, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xd4,
+	0x01, 0x0a, 0x16, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x66, 0x75,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f,
+	0x66, 0x75, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x28,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x64, 0x12, 0x45,
+	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x7f, 0x0a, 0x17, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
 	0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x66, 0x75, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x14, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f, 0x66, 0x75, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x18,
-	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x77, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x49, 0x64, 0x22, 0x19, 0x0a, 0x17, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x32, 0x97, 0x02, 0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x7e, 0x0a, 0x0d, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
-	0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b,
-	0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x84, 0x01, 0x0a, 0x0f, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65,
-	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x37, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72,
+	0x45, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72,
 	0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x51, 0x5a, 0x4f, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x3b, 0x0a, 0x1a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x49, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x1b, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x48, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43,
+	0x54, 0x49, 0x4f, 0x4e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x32, 0xaa, 0x03, 0x0a, 0x0e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7e, 0x0a, 0x0d, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x35, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f,
+	0x6f, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x84, 0x01, 0x0a, 0x0f, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x37, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x90, 0x01, 0x0a,
+	0x13, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x3b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42,
+	0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79,
+	0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -355,27 +531,37 @@ func file_controller_servers_services_v1_session_service_proto_rawDescGZIP() []b
 	return file_controller_servers_services_v1_session_service_proto_rawDescData
 }
 
-var file_controller_servers_services_v1_session_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_controller_servers_services_v1_session_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_controller_servers_services_v1_session_service_proto_goTypes = []interface{}{
 	(*LookupSessionRequest)(nil),             // 0: controller.servers.services.v1.LookupSessionRequest
 	(*LookupSessionResponse)(nil),            // 1: controller.servers.services.v1.LookupSessionResponse
 	(*ActivateSessionRequest)(nil),           // 2: controller.servers.services.v1.ActivateSessionRequest
 	(*ActivateSessionResponse)(nil),          // 3: controller.servers.services.v1.ActivateSessionResponse
-	(*targets.SessionAuthorizationData)(nil), // 4: controller.api.resources.targets.v1.SessionAuthorizationData
-	(*timestamp.Timestamp)(nil),              // 5: google.protobuf.Timestamp
+	(*AuthorizeConnectionRequest)(nil),       // 4: controller.servers.services.v1.AuthorizeConnectionRequest
+	(*AuthorizeConnectionResponse)(nil),      // 5: controller.servers.services.v1.AuthorizeConnectionResponse
+	(*targets.SessionAuthorizationData)(nil), // 6: controller.api.resources.targets.v1.SessionAuthorizationData
+	(*timestamp.Timestamp)(nil),              // 7: google.protobuf.Timestamp
+	(SESSIONSTATUS)(0),                       // 8: controller.servers.services.v1.SESSIONSTATUS
+	(CONNECTIONSTATUS)(0),                    // 9: controller.servers.services.v1.CONNECTIONSTATUS
 }
 var file_controller_servers_services_v1_session_service_proto_depIdxs = []int32{
-	4, // 0: controller.servers.services.v1.LookupSessionResponse.authorization:type_name -> controller.api.resources.targets.v1.SessionAuthorizationData
-	5, // 1: controller.servers.services.v1.LookupSessionResponse.expiration:type_name -> google.protobuf.Timestamp
-	0, // 2: controller.servers.services.v1.SessionService.LookupSession:input_type -> controller.servers.services.v1.LookupSessionRequest
-	2, // 3: controller.servers.services.v1.SessionService.ActivateSession:input_type -> controller.servers.services.v1.ActivateSessionRequest
-	1, // 4: controller.servers.services.v1.SessionService.LookupSession:output_type -> controller.servers.services.v1.LookupSessionResponse
-	3, // 5: controller.servers.services.v1.SessionService.ActivateSession:output_type -> controller.servers.services.v1.ActivateSessionResponse
-	4, // [4:6] is the sub-list for method output_type
-	2, // [2:4] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	6, // 0: controller.servers.services.v1.LookupSessionResponse.authorization:type_name -> controller.api.resources.targets.v1.SessionAuthorizationData
+	7, // 1: controller.servers.services.v1.LookupSessionResponse.expiration:type_name -> google.protobuf.Timestamp
+	8, // 2: controller.servers.services.v1.LookupSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	8, // 3: controller.servers.services.v1.ActivateSessionRequest.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	8, // 4: controller.servers.services.v1.ActivateSessionResponse.status:type_name -> controller.servers.services.v1.SESSIONSTATUS
+	9, // 5: controller.servers.services.v1.AuthorizeConnectionResponse.status:type_name -> controller.servers.services.v1.CONNECTIONSTATUS
+	0, // 6: controller.servers.services.v1.SessionService.LookupSession:input_type -> controller.servers.services.v1.LookupSessionRequest
+	2, // 7: controller.servers.services.v1.SessionService.ActivateSession:input_type -> controller.servers.services.v1.ActivateSessionRequest
+	4, // 8: controller.servers.services.v1.SessionService.AuthorizeConnection:input_type -> controller.servers.services.v1.AuthorizeConnectionRequest
+	1, // 9: controller.servers.services.v1.SessionService.LookupSession:output_type -> controller.servers.services.v1.LookupSessionResponse
+	3, // 10: controller.servers.services.v1.SessionService.ActivateSession:output_type -> controller.servers.services.v1.ActivateSessionResponse
+	5, // 11: controller.servers.services.v1.SessionService.AuthorizeConnection:output_type -> controller.servers.services.v1.AuthorizeConnectionResponse
+	9, // [9:12] is the sub-list for method output_type
+	6, // [6:9] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
 }
 
 func init() { file_controller_servers_services_v1_session_service_proto_init() }
@@ -383,6 +569,7 @@ func file_controller_servers_services_v1_session_service_proto_init() {
 	if File_controller_servers_services_v1_session_service_proto != nil {
 		return
 	}
+	file_controller_servers_services_v1_server_coordination_service_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_controller_servers_services_v1_session_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*LookupSessionRequest); i {
@@ -432,6 +619,30 @@ func file_controller_servers_services_v1_session_service_proto_init() {
 				return nil
 			}
 		}
+		file_controller_servers_services_v1_session_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthorizeConnectionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_servers_services_v1_session_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthorizeConnectionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -439,7 +650,7 @@ func file_controller_servers_services_v1_session_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_servers_services_v1_session_service_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -470,6 +681,8 @@ type SessionServiceClient interface {
 	LookupSession(ctx context.Context, in *LookupSessionRequest, opts ...grpc.CallOption) (*LookupSessionResponse, error)
 	// ActivateSession allows a worker to activate a session on a controller.
 	ActivateSession(ctx context.Context, in *ActivateSessionRequest, opts ...grpc.CallOption) (*ActivateSessionResponse, error)
+	// AuthorizeConnection allows a worker to activate a session on a controller.
+	AuthorizeConnection(ctx context.Context, in *AuthorizeConnectionRequest, opts ...grpc.CallOption) (*AuthorizeConnectionResponse, error)
 }
 
 type sessionServiceClient struct {
@@ -498,6 +711,15 @@ func (c *sessionServiceClient) ActivateSession(ctx context.Context, in *Activate
 	return out, nil
 }
 
+func (c *sessionServiceClient) AuthorizeConnection(ctx context.Context, in *AuthorizeConnectionRequest, opts ...grpc.CallOption) (*AuthorizeConnectionResponse, error) {
+	out := new(AuthorizeConnectionResponse)
+	err := c.cc.Invoke(ctx, "/controller.servers.services.v1.SessionService/AuthorizeConnection", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // SessionServiceServer is the server API for SessionService service.
 type SessionServiceServer interface {
 	// GetSession allows a worker to retrieve session information from the
@@ -505,6 +727,8 @@ type SessionServiceServer interface {
 	LookupSession(context.Context, *LookupSessionRequest) (*LookupSessionResponse, error)
 	// ActivateSession allows a worker to activate a session on a controller.
 	ActivateSession(context.Context, *ActivateSessionRequest) (*ActivateSessionResponse, error)
+	// AuthorizeConnection allows a worker to activate a session on a controller.
+	AuthorizeConnection(context.Context, *AuthorizeConnectionRequest) (*AuthorizeConnectionResponse, error)
 }
 
 // UnimplementedSessionServiceServer can be embedded to have forward compatible implementations.
@@ -517,6 +741,9 @@ func (*UnimplementedSessionServiceServer) LookupSession(context.Context, *Lookup
 func (*UnimplementedSessionServiceServer) ActivateSession(context.Context, *ActivateSessionRequest) (*ActivateSessionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ActivateSession not implemented")
 }
+func (*UnimplementedSessionServiceServer) AuthorizeConnection(context.Context, *AuthorizeConnectionRequest) (*AuthorizeConnectionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AuthorizeConnection not implemented")
+}
 
 func RegisterSessionServiceServer(s *grpc.Server, srv SessionServiceServer) {
 	s.RegisterService(&_SessionService_serviceDesc, srv)
@@ -558,6 +785,24 @@ func _SessionService_ActivateSession_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SessionService_AuthorizeConnection_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AuthorizeConnectionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SessionServiceServer).AuthorizeConnection(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.servers.services.v1.SessionService/AuthorizeConnection",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SessionServiceServer).AuthorizeConnection(ctx, req.(*AuthorizeConnectionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _SessionService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "controller.servers.services.v1.SessionService",
 	HandlerType: (*SessionServiceServer)(nil),
@@ -570,6 +815,10 @@ var _SessionService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "ActivateSession",
 			Handler:    _SessionService_ActivateSession_Handler,
 		},
+		{
+			MethodName: "AuthorizeConnection",
+			Handler:    _SessionService_AuthorizeConnection_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "controller/servers/services/v1/session_service.proto",
diff --git a/internal/proto/local/controller/servers/services/v1/server_coordination_service.proto b/internal/proto/local/controller/servers/services/v1/server_coordination_service.proto
index abcc6df0b..53e730135 100644
--- a/internal/proto/local/controller/servers/services/v1/server_coordination_service.proto
+++ b/internal/proto/local/controller/servers/services/v1/server_coordination_service.proto
@@ -14,46 +14,52 @@ service ServerCoordinationService {
   rpc Status(StatusRequest) returns (StatusResponse) {}
 }
 
+enum CONNECTIONSTATUS {
+  CONNECTIONSTATUS_UNSPECIFIED = 0;
+  CONNECTIONSTATUS_AUTHORIZED = 1;
+  CONNECTIONSTATUS_CONNECTED = 2;
+  CONNECTIONSTATUS_CLOSED = 3;
+}
+
 message Connection {
-  // TODO: Populate the connection specific info.
-  // byte up/down
-  // duration
-  // etc...
+  string connection_id = 1;
+  CONNECTIONSTATUS status = 2;
+}
+
+enum SESSIONSTATUS {
+  SESSIONSTATUS_UNSPECIFIED = 0;
+  SESSIONSTATUS_PENDING = 1;
+  SESSIONSTATUS_ACTIVE = 2;
+  SESSIONSTATUS_CANCELLING = 3;
+  SESSIONSTATUS_TERMINATED = 4;
 }
 
 message SessionJobInfo {
-  repeated Connection connections = 1;
+  string session_id = 1;
+  SESSIONSTATUS status = 2;
+  repeated Connection connections = 3;
+}
+
+enum JOBTYPE {
+  JOBTYPE_UNSPECIFIED = 0;
+  JOBTYPE_SESSION = 1;
 }
 
 message Job {
-  string job_id = 1;
-  enum JOBTYPE {
-    JOBTYPE_UNSPECIFIED = 0;
-    JOBTYPE_SESSION = 1;
-  }
-  JOBTYPE type = 2;
+  JOBTYPE type = 1;
   oneof job_info {
     // This value is specified when type is JOBTYPE_SESSION.
-    SessionJobInfo session_info = 3;
+    SessionJobInfo session_info = 2;
   }
 }
 
 message JobStatus {
-  enum STATUS {
-    // TODO: Get a better picture of what states general jobs can be in.
-    STATUS_UNSPECIFIED = 0;
-    // Specifies that the job is actively being handled by the worker.
-    STATUS_ACTIVE = 1;
-    STATUS_CANCELLED = 2;
-    STATUS_COMPLETED = 3;
-  }
   Job job = 1;
-  STATUS status = 3;
 }
 
 message StatusRequest {
   // The worker info. We could use information from the TLS connection but this
-  // is easier and going the other route doesn't provide much benefit -- if you
+  // is easier and going the other route doesn't provijde much benefit -- if you
   // get access to the key and spoof the connection, you're already compromised.
   servers.v1.Server worker = 10;
 
@@ -61,12 +67,16 @@ message StatusRequest {
   repeated JobStatus jobs = 20;
 }
 
+enum CHANGETYPE {
+  CHANGETYPE_UNSPECIFIED = 0;
+  // Indicates that the job should be cancelled on the worker; will also update
+  // the state on the worker.
+  CHANGETYPE_CANCEL = 1;
+  // Indicates to the worker to simply update its knowledge of the state.
+  CHANGETYPE_UPDATE_STATE = 2;
+}
+
 message JobChangeRequest {
-  enum CHANGETYPE {
-    CHANGETYPE_UNSPECIFIED = 0;
-    // Indicates that the job should be cancelled on the worker.
-    CHANGETYPE_CANCEL = 1;
-  }
   Job job = 1;
   CHANGETYPE request_type = 2;
 }
diff --git a/internal/proto/local/controller/servers/services/v1/session_service.proto b/internal/proto/local/controller/servers/services/v1/session_service.proto
index bcf42971f..8cbe1d72c 100644
--- a/internal/proto/local/controller/servers/services/v1/session_service.proto
+++ b/internal/proto/local/controller/servers/services/v1/session_service.proto
@@ -7,6 +7,7 @@ option go_package = "github.com/hashicorp/boundary/internal/gen/controller/serve
 import "google/protobuf/timestamp.proto";
 import "controller/servers/v1/servers.proto";
 import "controller/api/resources/targets/v1/target.proto";
+import "controller/servers/services/v1/server_coordination_service.proto";
 
 service SessionService {
 	// GetSession allows a worker to retrieve session information from the
@@ -15,6 +16,9 @@ service SessionService {
 	
 	// ActivateSession allows a worker to activate a session on a controller.
 	rpc ActivateSession(ActivateSessionRequest) returns (ActivateSessionResponse) {}
+
+	// AuthorizeConnection allows a worker to activate a session on a controller.
+	rpc AuthorizeConnection(AuthorizeConnectionRequest) returns (AuthorizeConnectionResponse) {}
 }
 
 message LookupSessionRequest {
@@ -30,6 +34,7 @@ message LookupSessionResponse {
 	uint32 version = 30;
 	string endpoint = 40;
 	google.protobuf.Timestamp expiration = 50;
+	controller.servers.services.v1.SESSIONSTATUS status = 60;
 }
 
 message ActivateSessionRequest {
@@ -37,6 +42,19 @@ message ActivateSessionRequest {
 	string tofu_token = 20;
 	uint32 version = 30;
 	string worker_id = 40;
+	controller.servers.services.v1.SESSIONSTATUS status = 50;
 }
 
-message ActivateSessionResponse{}
\ No newline at end of file
+message ActivateSessionResponse{
+	string session_id = 10;
+	controller.servers.services.v1.SESSIONSTATUS status = 20;
+}
+
+message AuthorizeConnectionRequest{
+	string session_id = 10;
+}
+
+message AuthorizeConnectionResponse{
+	string connection_id = 10;
+	controller.servers.services.v1.CONNECTIONSTATUS status = 20;
+}
\ No newline at end of file
diff --git a/internal/servers/controller/handlers/targets/target_service.go b/internal/servers/controller/handlers/targets/target_service.go
index d278e7905..90ddf4da9 100644
--- a/internal/servers/controller/handlers/targets/target_service.go
+++ b/internal/servers/controller/handlers/targets/target_service.go
@@ -290,7 +290,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		hostId    string
 	}
 
-	var chosenId compoundHost
+	var chosenId *compoundHost
 	requestedId := req.GetHostId()
 	staticHostRepo, err := s.staticHostRepoFn()
 	if err != nil {
@@ -298,6 +298,8 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 	}
 
 	hostIds := make([]compoundHost, 0, len(hostSets)*10)
+
+HostSetIterationLoop:
 	for _, tSet := range hostSets {
 		hsId := tSet.PublicId
 		switch host.SubtypeFromId(hsId) {
@@ -309,14 +311,14 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 			for _, host := range hosts {
 				compoundId := compoundHost{hostSetId: hsId, hostId: host.PublicId}
 				if host.PublicId == requestedId {
-					chosenId = compoundId
-					goto HOST_GATHERING_DONE
+					chosenId = &compoundId
+					break HostSetIterationLoop
 				}
 				hostIds = append(hostIds, compoundId)
 			}
 		}
 	}
-	if requestedId != "" {
+	if requestedId != "" && chosenId == nil {
 		// We didn't find it
 		return nil, handlers.InvalidArgumentErrorf(
 			"Errors in provided fields.",
@@ -324,9 +326,8 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 				"host_id": "The requested host id is not available.",
 			})
 	}
-	chosenId = hostIds[rand.Intn(len(hostIds))]
+	chosenId = &hostIds[rand.Intn(len(hostIds))]
 
-HOST_GATHERING_DONE:
 	// Generate the endpoint URL
 	endpointUrl := &url.URL{
 		Scheme: t.GetType(),
diff --git a/internal/servers/controller/handlers/workers/worker_service.go b/internal/servers/controller/handlers/workers/worker_service.go
index fc860d56f..ff87c3f16 100644
--- a/internal/servers/controller/handlers/workers/worker_service.go
+++ b/internal/servers/controller/handlers/workers/worker_service.go
@@ -2,7 +2,6 @@ package workers
 
 import (
 	"context"
-	"encoding/base64"
 	"sync"
 	"time"
 
@@ -23,7 +22,6 @@ type workerServiceServer struct {
 	sessionRepoFn common.SessionRepoFactory
 	updateTimes   *sync.Map
 	kms           *kms.Kms
-	jobCancelMap  *sync.Map
 }
 
 func NewWorkerServiceServer(
@@ -38,7 +36,6 @@ func NewWorkerServiceServer(
 		sessionRepoFn: sessionRepoFn,
 		updateTimes:   updateTimes,
 		kms:           kms,
-		jobCancelMap:  new(sync.Map),
 	}
 }
 
@@ -62,18 +59,64 @@ func (ws *workerServiceServer) Status(ctx context.Context, req *pbs.StatusReques
 	ret := &pbs.StatusResponse{
 		Controllers: controllers,
 	}
-	ws.jobCancelMap.Range(func(key, value interface{}) bool {
-		ret.JobsRequests = append(ret.JobsRequests, &pbs.JobChangeRequest{
-			Job: &pbs.Job{
-				JobId: key.(string),
-				Type:  pbs.Job_JOBTYPE_SESSION,
-			},
-			RequestType: 0,
-		})
-		return true
-	})
-	for _, j := range ret.JobsRequests {
-		ws.jobCancelMap.Delete(j.GetJob().GetJobId())
+
+	// Happy path
+	if len(req.GetJobs()) == 0 {
+		return ret, nil
+	}
+
+	sessRepo, err := ws.sessionRepoFn()
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "Error getting session repo: %v", err)
+	}
+
+	for _, jobStatus := range req.GetJobs() {
+		switch jobStatus.Job.GetType() {
+		// Check for session cancellation
+		case pbs.JOBTYPE_JOBTYPE_SESSION:
+			si := jobStatus.GetJob().GetSessionInfo()
+			if si == nil {
+				return nil, status.Error(codes.Internal, "Error getting session info at status time")
+			}
+			switch si.Status {
+			case pbs.SESSIONSTATUS_SESSIONSTATUS_CANCELLING,
+				pbs.SESSIONSTATUS_SESSIONSTATUS_TERMINATED:
+				// No need to see about canceling anything
+				continue
+			}
+			sessionId := si.GetSessionId()
+			sessionInfo, sessionStates, err := sessRepo.LookupSession(ctx, sessionId)
+			if err != nil {
+				return nil, status.Errorf(codes.Internal, "Error looking up session with id %s: %v", sessionId, err)
+			}
+			if sessionInfo == nil {
+				return nil, status.Errorf(codes.Internal, "Unknown session ID %s at status time.", sessionId)
+			}
+			if len(sessionStates) == 0 {
+				return nil, status.Error(codes.Internal, "Empty session states during lookup at status time.")
+			}
+			// If the session from the DB is in canceling status, and we're
+			// here, it means the job is in pending or active; cancel it. If
+			// it's in termianted status something went wrong and we're
+			// mismatched, so ensure we cancel it also.
+			currState := sessionStates[0].Status
+			switch currState {
+			case session.StatusCancelling,
+				session.StatusTerminated:
+				ret.JobsRequests = append(ret.JobsRequests, &pbs.JobChangeRequest{
+					Job: &pbs.Job{
+						Type: pbs.JOBTYPE_JOBTYPE_SESSION,
+						JobInfo: &pbs.Job_SessionInfo{
+							SessionInfo: &pbs.SessionJobInfo{
+								SessionId: sessionId,
+								Status:    currState.ProtoVal(),
+							},
+						},
+					},
+					RequestType: pbs.CHANGETYPE_CHANGETYPE_CANCEL,
+				})
+			}
+		}
 	}
 	return ret, nil
 }
@@ -83,24 +126,28 @@ func (ws *workerServiceServer) LookupSession(ctx context.Context, req *pbs.Looku
 
 	sessRepo, err := ws.sessionRepoFn()
 	if err != nil {
-		return nil, status.Errorf(codes.Internal, "error getting session repo: %v", err)
+		return nil, status.Errorf(codes.Internal, "Error getting session repo: %v", err)
 	}
 
-	sessionInfo, _, err := sessRepo.LookupSession(ctx, req.GetSessionId())
+	sessionInfo, sessionStates, err := sessRepo.LookupSession(ctx, req.GetSessionId())
 	if err != nil {
-		return nil, status.Errorf(codes.Internal, "error looking up session: %v", err)
+		return nil, status.Errorf(codes.Internal, "Error looking up session: %v", err)
 	}
 	if sessionInfo == nil {
 		return nil, status.Error(codes.PermissionDenied, "Unknown session ID.")
 	}
+	if len(sessionStates) == 0 {
+		return nil, status.Error(codes.Internal, "Empty session states during lookup.")
+	}
 
 	resp := &pbs.LookupSessionResponse{
 		Authorization: &targets.SessionAuthorizationData{
 			SessionId:   sessionInfo.GetPublicId(),
 			Certificate: sessionInfo.Certificate,
 		},
+		Status:     sessionStates[0].Status.ProtoVal(),
 		Version:    sessionInfo.Version,
-		TofuToken:  base64.StdEncoding.EncodeToString(sessionInfo.TofuToken),
+		TofuToken:  string(sessionInfo.TofuToken),
 		Endpoint:   sessionInfo.Endpoint,
 		Expiration: sessionInfo.ExpirationTime.Timestamp,
 	}
@@ -128,7 +175,7 @@ func (ws *workerServiceServer) ActivateSession(ctx context.Context, req *pbs.Act
 		return nil, status.Errorf(codes.Internal, "error getting session repo: %v", err)
 	}
 
-	sessionInfo, _, err := sessRepo.ActivateSession(
+	sessionInfo, sessionStates, err := sessRepo.ActivateSession(
 		ctx,
 		req.GetSessionId(),
 		req.GetVersion(),
@@ -141,6 +188,37 @@ func (ws *workerServiceServer) ActivateSession(ctx context.Context, req *pbs.Act
 	if sessionInfo == nil {
 		return nil, status.Error(codes.PermissionDenied, "Unknown session ID.")
 	}
+	if len(sessionStates) == 0 {
+		return nil, status.Error(codes.Internal, "Invalid session state in activate response.")
+	}
 
-	return &pbs.ActivateSessionResponse{}, nil
+	return &pbs.ActivateSessionResponse{
+		SessionId: sessionInfo.GetPublicId(),
+		Status:    sessionStates[0].Status.ProtoVal(),
+	}, nil
+}
+
+func (ws *workerServiceServer) AuthorizeConnection(ctx context.Context, req *pbs.AuthorizeConnectionRequest) (*pbs.AuthorizeConnectionResponse, error) {
+	ws.logger.Trace("got authorize connection request from worker", "session_id", req.GetSessionId())
+
+	sessRepo, err := ws.sessionRepoFn()
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "error getting session repo: %v", err)
+	}
+
+	connectionInfo, connStates, _, err := sessRepo.AuthorizeConnection(ctx, req.GetSessionId())
+	if err != nil {
+		return nil, err
+	}
+	if connectionInfo == nil {
+		return nil, status.Error(codes.Internal, "Invalid authorize connection response.")
+	}
+	if len(connStates) == 0 {
+		return nil, status.Error(codes.Internal, "Invalid connection state in authorize response.")
+	}
+
+	return &pbs.AuthorizeConnectionResponse{
+		ConnectionId: connectionInfo.GetPublicId(),
+		Status:       connStates[0].Status.ProtoVal(),
+	}, nil
 }
diff --git a/internal/servers/worker/handler.go b/internal/servers/worker/handler.go
index e8bc57aa6..143fcfc8c 100644
--- a/internal/servers/worker/handler.go
+++ b/internal/servers/worker/handler.go
@@ -5,7 +5,7 @@ import (
 	"net/http"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/gen/controller/servers/services"
+	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 	"github.com/hashicorp/boundary/internal/proxy"
 	"github.com/hashicorp/shared-secure-libs/configutil"
 	"nhooyr.io/websocket"
@@ -40,13 +40,20 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 
 		w.logger.Trace("received TLS connection")
 
-		sessionInfoRaw, valid := w.sessionInfoMap.LoadAndDelete(sessionId)
+		siRaw, valid := w.sessionInfoMap.Load(sessionId)
 		if !valid {
 			w.logger.Error("session not found in info map", "session_id", sessionId)
 			wr.WriteHeader(http.StatusInternalServerError)
 			return
 		}
-		sessionInfo := sessionInfoRaw.(*services.LookupSessionResponse)
+		si := siRaw.(*sessionInfo)
+		si.RLock()
+		expiration := si.lookupSessionResponse.GetExpiration()
+		tofuToken := si.lookupSessionResponse.GetTofuToken()
+		version := si.lookupSessionResponse.GetVersion()
+		endpoint := si.lookupSessionResponse.GetEndpoint()
+		sessStatus := si.status
+		si.RUnlock()
 
 		w.logger.Trace("found session in session info map")
 
@@ -64,15 +71,8 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 
 		w.logger.Trace("websocket upgrade done")
 
-		connCtx, connCancel := context.WithDeadline(r.Context(), sessionInfo.Expiration.AsTime())
-		w.cancellationMap.Store(sessionId, connCancel)
-		defer func() {
-			cancel, loaded := w.cancellationMap.LoadAndDelete(sessionId)
-			if !loaded {
-				return
-			}
-			cancel.(context.CancelFunc)()
-		}()
+		connCtx, connCancel := context.WithDeadline(r.Context(), expiration.AsTime())
+		defer connCancel()
 
 		var handshake proxy.ClientHandshake
 		if err := wspb.Read(connCtx, conn, &handshake); err != nil {
@@ -88,23 +88,46 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 
 		w.logger.Trace("proxy handshake finished")
 
-		if sessionInfo.TofuToken != "" {
-			if sessionInfo.TofuToken != handshake.GetTofuToken() {
+		if tofuToken != "" {
+			if tofuToken != handshake.GetTofuToken() {
 				w.logger.Error("WARNING: mismatched tofu token", "session_id", sessionId)
 				conn.Close(websocket.StatusPolicyViolation, "tofu token not allowed")
 				return
 			}
 		} else {
+			if sessStatus != pbs.SESSIONSTATUS_SESSIONSTATUS_PENDING {
+				w.logger.Error("no tofu token but not in correct session state", "error", err)
+				conn.Close(websocket.StatusInternalError, "refusing to activate session")
+				return
+			}
 			w.logger.Trace("activating session")
-			if err := w.activateSession(r.Context(), handshake.GetTofuToken(), sessionInfo); err != nil {
+			sessStatus, err = w.activateSession(r.Context(), sessionId, handshake.GetTofuToken(), version)
+			if err != nil {
 				w.logger.Error("unable to validate session", "error", err)
 				conn.Close(websocket.StatusInternalError, "unable to activate session")
 				return
 			}
 		}
 
+		var ci *connInfo
+		ci, err = w.authorizeConnection(r.Context(), sessionId)
+		if err != nil {
+			w.logger.Error("unable to authorize conneciton", "error", err)
+			conn.Close(websocket.StatusInternalError, "unable to authorize connection")
+			return
+		}
+
+		si.Lock()
+		ci.connCtx = connCtx
+		ci.connCancel = connCancel
+		si.connInfoMap[ci.id] = ci
+		si.status = sessStatus
+		si.Unlock()
+
+		w.logger.Trace("authorized connection", "connection_id", ci.id)
+
 		handshakeResult := &proxy.HandshakeResult{
-			Expiration: sessionInfo.GetExpiration(),
+			Expiration: expiration,
 		}
 		if err := wspb.Write(connCtx, conn, handshakeResult); err != nil {
 			w.logger.Error("error sending handshake result to client", "error", err)
@@ -114,7 +137,7 @@ func (w *Worker) handleProxy() http.HandlerFunc {
 
 		switch conn.Subprotocol() {
 		case globals.TcpProxyV1:
-			w.handleTcpProxyV1(connCtx, conn, sessionInfo)
+			w.handleTcpProxyV1(connCtx, conn, sessionId, endpoint)
 		default:
 			conn.Close(websocket.StatusProtocolError, "unsupported-protocol")
 			return
diff --git a/internal/servers/worker/session.go b/internal/servers/worker/session.go
index 26e6b8ed7..96a6886d8 100644
--- a/internal/servers/worker/session.go
+++ b/internal/servers/worker/session.go
@@ -8,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"sync"
 	"time"
 
-	"github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 )
 
@@ -18,6 +18,21 @@ const (
 	validateSessionTimeout = 90 * time.Second
 )
 
+type connInfo struct {
+	id         string
+	connCtx    context.Context
+	connCancel context.CancelFunc
+	status     pbs.CONNECTIONSTATUS
+}
+
+type sessionInfo struct {
+	sync.RWMutex
+	sessionTls            *tls.Config
+	status                pbs.SESSIONSTATUS
+	lookupSessionResponse *pbs.LookupSessionResponse
+	connInfoMap           map[string]*connInfo
+}
+
 func (w *Worker) getSessionTls(hello *tls.ClientHelloInfo) (*tls.Config, error) {
 	var sessionId string
 	switch {
@@ -85,37 +100,76 @@ func (w *Worker) getSessionTls(hello *tls.ClientHelloInfo) (*tls.Config, error)
 		MinVersion: tls.VersionTLS13,
 	}
 
+	si := &sessionInfo{
+		sessionTls:            tlsConf,
+		lookupSessionResponse: resp,
+		status:                resp.GetStatus(),
+		connInfoMap:           make(map[string]*connInfo),
+	}
 	// TODO: Periodicially clean this up. We can't rely on things in here but
 	// not in cancellation because they could be on the way to being
 	// established. However, since cert lifetimes are short, we can simply range
 	// through and remove values that are expired.
-	w.sessionInfoMap.Store(sessionId, resp)
+	actualSiRaw, loaded := w.sessionInfoMap.LoadOrStore(sessionId, si)
+	if loaded {
+		// Update the response to the latest
+		actualSi := actualSiRaw.(*sessionInfo)
+		actualSi.Lock()
+		actualSi.lookupSessionResponse = resp
+		actualSi.Unlock()
+	}
 
 	w.logger.Trace("returning TLS configuration", "session_id", sessionId)
 	return tlsConf, nil
 }
 
-func (w *Worker) activateSession(ctx context.Context, tofuToken string, sess *services.LookupSessionResponse) error {
+func (w *Worker) activateSession(ctx context.Context, sessionId, tofuToken string, version uint32) (pbs.SESSIONSTATUS, error) {
 	rawConn := w.controllerSessionConn.Load()
 	if rawConn == nil {
-		return errors.New("could not get a controller client")
+		return pbs.SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED, errors.New("could not get a controller client")
 	}
 	conn, ok := rawConn.(pbs.SessionServiceClient)
 	if !ok {
-		return errors.New("could not cast atomic controller client to the real thing")
+		return pbs.SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED, errors.New("could not cast atomic controller client to the real thing")
 	}
 	if conn == nil {
-		return errors.New("controller client is nil")
+		return pbs.SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED, errors.New("controller client is nil")
 	}
 
-	_, err := conn.ActivateSession(ctx, &pbs.ActivateSessionRequest{
-		SessionId: sess.GetAuthorization().GetSessionId(),
+	resp, err := conn.ActivateSession(ctx, &pbs.ActivateSessionRequest{
+		SessionId: sessionId,
 		TofuToken: tofuToken,
-		Version:   sess.GetVersion(),
+		Version:   version,
 		WorkerId:  w.conf.RawConfig.Worker.Name,
 	})
 	if err != nil {
-		return fmt.Errorf("error activating session: %w", err)
+		return pbs.SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED, fmt.Errorf("error activating session: %w", err)
 	}
-	return nil
+	return resp.GetStatus(), nil
+}
+
+func (w *Worker) authorizeConnection(ctx context.Context, sessionId string) (*connInfo, error) {
+	rawConn := w.controllerSessionConn.Load()
+	if rawConn == nil {
+		return nil, errors.New("could not get a controller client")
+	}
+	conn, ok := rawConn.(pbs.SessionServiceClient)
+	if !ok {
+		return nil, errors.New("could not cast atomic controller client to the real thing")
+	}
+	if conn == nil {
+		return nil, errors.New("controller client is nil")
+	}
+
+	resp, err := conn.AuthorizeConnection(ctx, &pbs.AuthorizeConnectionRequest{
+		SessionId: sessionId,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error authorizing connection: %w", err)
+	}
+
+	return &connInfo{
+		id:     resp.ConnectionId,
+		status: resp.GetStatus(),
+	}, nil
 }
diff --git a/internal/servers/worker/status.go b/internal/servers/worker/status.go
index 36092e01b..9dba182ea 100644
--- a/internal/servers/worker/status.go
+++ b/internal/servers/worker/status.go
@@ -46,10 +46,32 @@ func (w *Worker) startStatusTicking(cancelCtx context.Context) {
 
 			case <-timer.C:
 				var activeJobs []*pbs.JobStatus
-				w.cancellationMap.Range(func(key, value interface{}) bool {
+				w.sessionInfoMap.Range(func(key, value interface{}) bool {
+					var jobInfo pbs.SessionJobInfo
+					sessionId := key.(string)
+					si := value.(*sessionInfo)
+					si.RLock()
+					status := si.status
+					connections := make([]*pbs.Connection, 0, len(si.connInfoMap))
+					for k, v := range si.connInfoMap {
+						connections = append(connections, &pbs.Connection{
+							ConnectionId: k,
+							Status:       v.status,
+						})
+					}
+					si.RUnlock()
+					jobInfo.SessionId = sessionId
 					activeJobs = append(activeJobs, &pbs.JobStatus{
-						Job:    &pbs.Job{JobId: key.(string)},
-						Status: pbs.JobStatus_STATUS_ACTIVE,
+						Job: &pbs.Job{
+							Type: pbs.JOBTYPE_JOBTYPE_SESSION,
+							JobInfo: &pbs.Job_SessionInfo{
+								SessionInfo: &pbs.SessionJobInfo{
+									SessionId:   sessionId,
+									Status:      status,
+									Connections: connections,
+								},
+							},
+						},
 					})
 					return true
 				})
@@ -74,16 +96,40 @@ func (w *Worker) startStatusTicking(cancelCtx context.Context) {
 						addrs = append(addrs, resolver.Address{Addr: v.Address})
 						strAddrs = append(strAddrs, v.Address)
 					}
-					w.Resolver().UpdateState(resolver.State{Addresses: addrs})
 					w.logger.Trace("found controllers", "addresses", strAddrs)
+					switch len(strAddrs) {
+					case 0:
+						w.logger.Warn("got no controller addresses from controller; possibly prior to first status save, not persisting")
+					default:
+						w.Resolver().UpdateState(resolver.State{Addresses: addrs})
+					}
 					w.lastStatusSuccess.Store(&LastStatusInformation{StatusResponse: result, StatusTime: time.Now()})
 
-					for _, id := range result.GetJobsRequests() {
-						if cancel, ok := w.cancellationMap.LoadAndDelete(id); ok {
-							cancel.(context.CancelFunc)()
-							w.logger.Info("canceled job", "job_id", id)
-						} else {
-							w.logger.Warn("asked to cancel job but could not find a cancellation function for it", "job_id", id)
+					for _, request := range result.GetJobsRequests() {
+						switch request.GetRequestType() {
+						case pbs.CHANGETYPE_CHANGETYPE_UPDATE_STATE,
+							pbs.CHANGETYPE_CHANGETYPE_CANCEL:
+							switch request.GetJob().GetType() {
+							case pbs.JOBTYPE_JOBTYPE_SESSION:
+								sessInfo := request.GetJob().GetSessionInfo()
+								sessionId := sessInfo.GetSessionId()
+								siRaw, ok := w.sessionInfoMap.Load(sessionId)
+								if !ok {
+									w.logger.Warn("asked to cancel session but could not find a local information for it", "session_id", sessionId)
+									continue
+								}
+								si := siRaw.(*sessionInfo)
+								si.Lock()
+								si.status = sessInfo.GetStatus()
+								if request.GetRequestType() == pbs.CHANGETYPE_CHANGETYPE_CANCEL {
+									for k, v := range si.connInfoMap {
+										v.connCancel()
+										w.logger.Info("terminated connection", "session_id", sessionId, "connection_id", k)
+										v.status = pbs.CONNECTIONSTATUS_CONNECTIONSTATUS_CLOSED
+									}
+								}
+								si.Unlock()
+							}
 						}
 					}
 				}
diff --git a/internal/servers/worker/tcp_proxy.go b/internal/servers/worker/tcp_proxy.go
index da5c777f6..ff4923e06 100644
--- a/internal/servers/worker/tcp_proxy.go
+++ b/internal/servers/worker/tcp_proxy.go
@@ -7,26 +7,24 @@ import (
 	"net/url"
 	"sync"
 
-	"github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 	"nhooyr.io/websocket"
 )
 
-func (w *Worker) handleTcpProxyV1(connCtx context.Context, conn *websocket.Conn, sessionInfo *services.LookupSessionResponse) {
-	sessionId := sessionInfo.GetAuthorization().GetSessionId()
-	sessionUrl, err := url.Parse(sessionInfo.Endpoint)
+func (w *Worker) handleTcpProxyV1(connCtx context.Context, conn *websocket.Conn, sessionId, endpoint string) {
+	sessionUrl, err := url.Parse(endpoint)
 	if err != nil {
-		w.logger.Error("error parsing endpoint information", "error", err, "session_id", sessionId, "endpoint", sessionInfo.Endpoint)
+		w.logger.Error("error parsing endpoint information", "error", err, "session_id", sessionId, "endpoint", endpoint)
 		conn.Close(websocket.StatusInternalError, "cannot parse endpoint url")
 		return
 	}
 	if sessionUrl.Scheme != "tcp" {
-		w.logger.Error("invalid scheme for tcp proxy", "error", err, "session_id", sessionId, "endpoint", sessionInfo.Endpoint)
+		w.logger.Error("invalid scheme for tcp proxy", "error", err, "session_id", sessionId, "endpoint", endpoint)
 		conn.Close(websocket.StatusInternalError, "invalid scheme for type")
 		return
 	}
 	remoteConn, err := net.Dial("tcp", sessionUrl.Host)
 	if err != nil {
-		w.logger.Error("error dialing endpoint", "error", err, "endpoint", sessionInfo.Endpoint)
+		w.logger.Error("error dialing endpoint", "error", err, "endpoint", endpoint)
 		conn.Close(websocket.StatusInternalError, "endpoint-dialing")
 		return
 	}
diff --git a/internal/servers/worker/worker.go b/internal/servers/worker/worker.go
index 6e6d55e4b..471a95df9 100644
--- a/internal/servers/worker/worker.go
+++ b/internal/servers/worker/worker.go
@@ -34,7 +34,6 @@ type Worker struct {
 
 	controllerSessionConn *atomic.Value
 	sessionInfoMap        *sync.Map
-	cancellationMap       *sync.Map
 }
 
 func New(conf *Config) (*Worker, error) {
@@ -47,7 +46,6 @@ func New(conf *Config) (*Worker, error) {
 		controllerResolverCleanup: new(atomic.Value),
 		controllerSessionConn:     new(atomic.Value),
 		sessionInfoMap:            new(sync.Map),
-		cancellationMap:           new(sync.Map),
 	}
 
 	w.lastStatusSuccess.Store((*LastStatusInformation)(nil))
diff --git a/internal/session/connection_state.go b/internal/session/connection_state.go
index c360bf160..2a0f38f24 100644
--- a/internal/session/connection_state.go
+++ b/internal/session/connection_state.go
@@ -7,6 +7,8 @@ import (
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"google.golang.org/protobuf/types/known/timestamppb"
+
+	workerpbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 )
 
 const (
@@ -27,12 +29,25 @@ func (s ConnectionStatus) String() string {
 	return string(s)
 }
 
+// ProtoVal returns the enum value corresponding to the state
+func (s ConnectionStatus) ProtoVal() workerpbs.CONNECTIONSTATUS {
+	switch s {
+	case StatusAuthorized:
+		return workerpbs.CONNECTIONSTATUS_CONNECTIONSTATUS_AUTHORIZED
+	case StatusConnected:
+		return workerpbs.CONNECTIONSTATUS_CONNECTIONSTATUS_CONNECTED
+	case StatusClosed:
+		return workerpbs.CONNECTIONSTATUS_CONNECTIONSTATUS_CLOSED
+	}
+	return workerpbs.CONNECTIONSTATUS_CONNECTIONSTATUS_UNSPECIFIED
+}
+
 // ConnectionState of the state of the connection
 type ConnectionState struct {
 	// ConnectionId is used to access the state via an API
 	ConnectionId string `json:"public_id,omitempty" gorm:"primary_key"`
 	// status of the connection
-	Status string `protobuf:"bytes,20,opt,name=status,proto3" json:"status,omitempty" gorm:"column:state"`
+	Status ConnectionStatus `protobuf:"bytes,20,opt,name=status,proto3" json:"status,omitempty" gorm:"column:state"`
 	// PreviousEndTime from the RDBMS
 	PreviousEndTime *timestamp.Timestamp `json:"previous_end_time,omitempty" gorm:"default:current_timestamp"`
 	// StartTime from the RDBMS
@@ -51,7 +66,7 @@ var _ db.VetForWriter = (*ConnectionState)(nil)
 func NewConnectionState(connectionId string, state ConnectionStatus, opt ...Option) (*ConnectionState, error) {
 	s := ConnectionState{
 		ConnectionId: connectionId,
-		Status:       state.String(),
+		Status:       state,
 	}
 	if err := s.validate("new connection state:"); err != nil {
 		return nil, err
diff --git a/internal/session/connection_state_test.go b/internal/session/connection_state_test.go
index eeabeb871..f08f635f4 100644
--- a/internal/session/connection_state_test.go
+++ b/internal/session/connection_state_test.go
@@ -40,7 +40,7 @@ func TestConnectionState_Create(t *testing.T) {
 			},
 			want: &ConnectionState{
 				ConnectionId: connection.PublicId,
-				Status:       StatusClosed.String(),
+				Status:       StatusClosed,
 			},
 			create: true,
 		},
diff --git a/internal/session/repository_session.go b/internal/session/repository_session.go
index 9d1ce7c44..bf84b317c 100644
--- a/internal/session/repository_session.go
+++ b/internal/session/repository_session.go
@@ -12,6 +12,8 @@ import (
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"github.com/hashicorp/boundary/internal/kms"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // CreateSession inserts into the repository and returns the new Session with
@@ -94,7 +96,7 @@ func (r *Repository) CreateSession(ctx context.Context, sessionWrapper wrapping.
 				return fmt.Errorf("%d states found for new session %s", len(foundStates), returnedSession.PublicId)
 			}
 			returnedState = foundStates[0]
-			if returnedState.Status != StatusPending.String() {
+			if returnedState.Status != StatusPending {
 				return fmt.Errorf("new session %s state is not valid: %s", returnedSession.PublicId, returnedState.Status)
 			}
 			return nil
@@ -289,11 +291,11 @@ func (r *Repository) TerminateSession(ctx context.Context, sessionId string, ses
 // an error of ErrInvalidStateForOperation.
 func (r *Repository) AuthorizeConnection(ctx context.Context, sessionId string) (*Connection, []*ConnectionState, *ConnectionAuthzSummary, error) {
 	if sessionId == "" {
-		return nil, nil, nil, fmt.Errorf("authorize connection: missing session id: %w", db.ErrInvalidParameter)
+		return nil, nil, nil, status.Errorf(codes.FailedPrecondition, "authorize connection: missing session id: %v", db.ErrInvalidParameter)
 	}
 	connectionId, err := newConnectionId()
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("authorize connection: %w", err)
+		return nil, nil, nil, status.Errorf(codes.Internal, "authorize connection: %v", err)
 	}
 
 	connection := AllocConnection()
@@ -306,13 +308,13 @@ func (r *Repository) AuthorizeConnection(ctx context.Context, sessionId string)
 		func(reader db.Reader, w db.Writer) error {
 			rowsAffected, err := w.Exec(authorizeConnectionCte, []interface{}{sessionId, connectionId})
 			if err != nil {
-				return fmt.Errorf("unable to authorize connection %s: %w", sessionId, err)
+				return status.Errorf(codes.Internal, "unable to authorize connection %s: %v", sessionId, err)
 			}
 			if rowsAffected == 0 {
-				return fmt.Errorf("session %s is not authorized (not active, expired or connection limit reached): %w", sessionId, ErrInvalidStateForOperation)
+				return status.Errorf(codes.PermissionDenied, "authorize connection: session %s is not authorized (not active, expired or connection limit reached): %v", sessionId, ErrInvalidStateForOperation)
 			}
 			if err := reader.LookupById(ctx, &connection); err != nil {
-				return fmt.Errorf("lookup connection: failed %w for %s", err, sessionId)
+				return status.Errorf(codes.Internal, "authorize connection: failed for session %s: %v", sessionId, err)
 			}
 			connectionStates, err = fetchConnectionStates(ctx, reader, connectionId, db.WithOrder("start_time desc"))
 			if err != nil {
@@ -322,7 +324,7 @@ func (r *Repository) AuthorizeConnection(ctx context.Context, sessionId string)
 		},
 	)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("authorize connection: %w", err)
+		return nil, nil, nil, err
 	}
 	authzSummary, err := r.sessionAuthzSummary(ctx, connection.SessionId)
 	if err != nil {
diff --git a/internal/session/state.go b/internal/session/state.go
index ae2436cd2..13a914ebe 100644
--- a/internal/session/state.go
+++ b/internal/session/state.go
@@ -7,6 +7,8 @@ import (
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"google.golang.org/protobuf/types/known/timestamppb"
+
+	workerpbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 )
 
 const (
@@ -28,12 +30,27 @@ func (s Status) String() string {
 	return string(s)
 }
 
+// ProtoVal returns the enum value corresponding to the state
+func (s Status) ProtoVal() workerpbs.SESSIONSTATUS {
+	switch s {
+	case StatusPending:
+		return workerpbs.SESSIONSTATUS_SESSIONSTATUS_PENDING
+	case StatusActive:
+		return workerpbs.SESSIONSTATUS_SESSIONSTATUS_ACTIVE
+	case StatusCancelling:
+		return workerpbs.SESSIONSTATUS_SESSIONSTATUS_CANCELLING
+	case StatusTerminated:
+		return workerpbs.SESSIONSTATUS_SESSIONSTATUS_TERMINATED
+	}
+	return workerpbs.SESSIONSTATUS_SESSIONSTATUS_UNSPECIFIED
+}
+
 // State of the session
 type State struct {
 	// SessionId references the session public id
 	SessionId string `json:"session_id,omitempty" gorm:"primary_key"`
 	// status of the session
-	Status string `json:"status,omitempty" gorm:"column:state"`
+	Status Status `json:"status,omitempty" gorm:"column:state"`
 	// PreviousEndTime from the RDBMS
 	PreviousEndTime *timestamp.Timestamp `json:"previous_end_time,omitempty" gorm:"default:current_timestamp"`
 	// StartTime from the RDBMS
@@ -52,7 +69,7 @@ var _ db.VetForWriter = (*State)(nil)
 func NewState(session_id string, state Status, opt ...Option) (*State, error) {
 	s := State{
 		SessionId: session_id,
-		Status:    state.String(),
+		Status:    state,
 	}
 
 	if err := s.validate("new session state:"); err != nil {
diff --git a/internal/session/state_test.go b/internal/session/state_test.go
index f8a51cdc4..272525bde 100644
--- a/internal/session/state_test.go
+++ b/internal/session/state_test.go
@@ -39,7 +39,7 @@ func TestState_Create(t *testing.T) {
 			},
 			want: &State{
 				SessionId: session.PublicId,
-				Status:    StatusPending.String(),
+				Status:    StatusPending,
 			},
 			create: true,
 		},