diff --git a/integration_tests/management/network_map_db/network_map_data_golden.json b/integration_tests/management/network_map_db/network_map_data_golden.json
index bb0ccd30b..a7a40302d 100644
--- a/integration_tests/management/network_map_db/network_map_data_golden.json
+++ b/integration_tests/management/network_map_db/network_map_data_golden.json
@@ -254,7 +254,9 @@
               "user-2"
             ]
           },
-          "AuthorizedUser": "user-3"
+          "AuthorizedUser": "user-3",
+          "SessionPubKey": "",
+          "SessionDisplayName": ""
         }
       ]
     }
diff --git a/integration_tests/management/network_map_db/policy_test.go b/integration_tests/management/network_map_db/policy_test.go
index 1f4c543da..9daba39c1 100644
--- a/integration_tests/management/network_map_db/policy_test.go
+++ b/integration_tests/management/network_map_db/policy_test.go
@@ -53,6 +53,19 @@ func TestGetPolicies(t *testing.T) {
 		 values('policy-4-rule-1','policy-4',false,null,null,null,null,'["group-two-resources-id"]',
 		        null,'{"ID":"domain-3","Type":"domain"}',null,null,null,null)`)
 
+	// VNC temporary-access rule: the session pubkey and display name are what
+	// the daemon's Noise_IK authorizer matches on, so they have to survive the
+	// components path as well as the legacy one.
+	execQuery(t, ctx,
+		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-5','policy-5-public','account-1',true,null)`)
+	execQuery(t, ctx,
+		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user, session_pub_key, session_display_name)
+		 values('policy-5-rule-1','policy-5',true,'accept','netbird-vnc',true,'["group-one-resource-id"]','["group-two-resources-id"]',
+		        null,null,null,null,null,'user-9','c2Vzc2lvbi1wdWJrZXktMzItYnl0ZXMtZXhhY3RseSE=','Alice Example')`)
+
 	policies, policyToDestinationResourceIdx, policyToDestinationGroupIdx, err := conn(t, ctx).GetPolicies(ctx, "account-1")
 	assert.NoError(t, err)
 
@@ -135,9 +148,32 @@ func TestGetPolicies(t *testing.T) {
 		},
 	})
 
+	assert.Contains(t, policies, nmdata.Policy{
+		ID:                  "policy-5",
+		PublicID:            "policy-5-public",
+		Enabled:             true,
+		SourcePostureChecks: nil,
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                 "policy-5",
+				PolicyID:           "policy-5",
+				Enabled:            true,
+				Action:             "accept",
+				Protocol:           "netbird-vnc",
+				Bidirectional:      true,
+				Sources:            []string{"group-one-resource-id"},
+				Destinations:       []string{"group-two-resources-id"},
+				AuthorizedUser:     "user-9",
+				SessionPubKey:      "c2Vzc2lvbi1wdWJrZXktMzItYnl0ZXMtZXhhY3RseSE=",
+				SessionDisplayName: "Alice Example",
+			},
+		},
+	})
+
 	assert.Equal(t, policyToDestinationGroupIdx, map[string]map[string]any{
 		"policy-1": {"group-one-resource-id": struct{}{}, "group-two-resources-id": struct{}{}},
 		"policy-2": {"group-two-resources-id": struct{}{}},
+		"policy-5": {"group-two-resources-id": struct{}{}},
 	})
 	assert.Equal(t, policyToDestinationResourceIdx, map[string]map[string]any{
 		"policy-1": {"domain-1": struct{}{}},
diff --git a/management/internals/network_map_db/pgsql/policy.go b/management/internals/network_map_db/pgsql/policy.go
index 45927d7a2..34f8c1eac 100644
--- a/management/internals/network_map_db/pgsql/policy.go
+++ b/management/internals/network_map_db/pgsql/policy.go
@@ -12,7 +12,7 @@ const (
 	GetPoliciesQuery = `
 	select p.id, p.public_id, p.enabled, p.source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, 
 	pr.sources, pr.destinations, pr.source_resource, pr.destination_resource, pr.ports, pr.port_ranges,
-	pr.authorized_groups, pr.authorized_user
+	pr.authorized_groups, pr.authorized_user, pr.session_pub_key, pr.session_display_name
 	from policies as p
 	left join policy_rules as pr on p.id = pr.policy_id 
 	where account_id=$1
diff --git a/management/internals/network_map_db/shared_types.go b/management/internals/network_map_db/shared_types.go
index bdd387877..f8cffed50 100644
--- a/management/internals/network_map_db/shared_types.go
+++ b/management/internals/network_map_db/shared_types.go
@@ -151,6 +151,8 @@ type Policy struct {
 	PortRanges          []byte         `nmap:"skip,json"`
 	AuthorizedGroups    []byte         `nmap:"skip,json"`
 	AuthorizedUser      sql.NullString `nmap:"skip"`
+	SessionPubKey       sql.NullString `nmap:"skip"`
+	SessionDisplayName  sql.NullString `nmap:"skip"`
 }
 
 // Depending on db interface LastLogin contains time in different formats:
@@ -458,6 +460,12 @@ func ConvertToNmdataPolicy(policies []Policy) ([]nmdata.Policy, map[string]map[s
 		if p.AuthorizedUser.Valid {
 			pr().AuthorizedUser = p.AuthorizedUser.String
 		}
+		if p.SessionPubKey.Valid {
+			pr().SessionPubKey = p.SessionPubKey.String
+		}
+		if p.SessionDisplayName.Valid {
+			pr().SessionDisplayName = p.SessionDisplayName.String
+		}
 
 		if policyRule != nil {
 			policyRule.ID = p.ID
diff --git a/management/internals/network_map_db/sqlite/policy.go b/management/internals/network_map_db/sqlite/policy.go
index 1a11f6e20..9db572ce9 100644
--- a/management/internals/network_map_db/sqlite/policy.go
+++ b/management/internals/network_map_db/sqlite/policy.go
@@ -11,7 +11,7 @@ const (
 	GetPoliciesQuery = `
 	select p.id, p.public_id, p.enabled, p.source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, 
 	pr.sources, pr.destinations, pr.source_resource, pr.destination_resource, pr.ports, pr.port_ranges,
-	pr.authorized_groups, pr.authorized_user
+	pr.authorized_groups, pr.authorized_user, pr.session_pub_key, pr.session_display_name
 	from policies as p
 	left join policy_rules as pr on p.id = pr.policy_id 
 	where account_id=?