diff --git a/doc/admin-guide/configuration/hrw4u.en.rst b/doc/admin-guide/configuration/hrw4u.en.rst
index 4a0fb3f6961..049454f33c0 100644
--- a/doc/admin-guide/configuration/hrw4u.en.rst
+++ b/doc/admin-guide/configuration/hrw4u.en.rst
@@ -710,9 +710,9 @@ Denied Sections
 ---------------
 
 The ``sections`` list accepts any of the HRW4U section names listed in the
-`Sections`_ table, plus ``VARS`` to deny the variable declaration block.
-A denied section causes the entire block to be rejected; the body is not
-validated.
+`Sections`_ table, plus ``VARS`` and ``SESSION_VARS`` to deny the variable
+declaration blocks. A denied section causes the entire block to be rejected;
+the body is not validated.
 
 Functions
 ---------
@@ -775,7 +775,7 @@ The ``language`` list accepts a fixed set of constructs:
 Construct        What it controls
 ================ ===================================================
 ``break``        The ``break;`` statement (early section exit)
-``variables``    The entire ``VARS`` section and all variable usage
+``variables``    The entire ``VARS`` and ``SESSION_VARS`` section and all variable usage
 ``else``         The ``else { ... }`` branch of conditionals
 ``elif``         The ``elif ... { ... }`` branch of conditionals
 ``in``           The ``in [...]`` and ``!in [...]`` set membership operators
diff --git a/tools/hrw4u/schema/sandbox.schema.json b/tools/hrw4u/schema/sandbox.schema.json
index 0e106dc4401..927e2d8e66d 100644
--- a/tools/hrw4u/schema/sandbox.schema.json
+++ b/tools/hrw4u/schema/sandbox.schema.json
@@ -45,7 +45,8 @@
               "READ_RESPONSE",
               "SEND_RESPONSE",
               "TXN_CLOSE",
-              "VARS"
+              "VARS",
+              "SESSION_VARS"
             ]
           },
           "uniqueItems": true
diff --git a/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.ast.txt b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.ast.txt
new file mode 100644
index 00000000000..a194f511720
--- /dev/null
+++ b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.ast.txt
@@ -0,0 +1 @@
+(program (programItem (section (sessionVarSection SESSION_VARS { (variables (variablesItem (variableDecl session_marked : bool ;))) }))) (programItem (section REMAP { (sectionBody (statement inbound.req.X-Marked = (value "1") ;)) })) <EOF>)
diff --git a/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.error.txt b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.error.txt
new file mode 100644
index 00000000000..974a8009f2c
--- /dev/null
+++ b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.error.txt
@@ -0,0 +1,2 @@
+'SESSION_VARS' is denied by sandbox policy (section)
+Feature denied by sandbox policy. Contact platform team.
diff --git a/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.input.txt b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.input.txt
new file mode 100644
index 00000000000..153339985a8
--- /dev/null
+++ b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.input.txt
@@ -0,0 +1,7 @@
+SESSION_VARS {
+    session_marked: bool;
+}
+
+REMAP {
+    inbound.req.X-Marked = "1";
+}
diff --git a/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.sandbox.yaml b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.sandbox.yaml
new file mode 100644
index 00000000000..43274b164a0
--- /dev/null
+++ b/tools/hrw4u/tests/data/sandbox/denied-section-session-vars.sandbox.yaml
@@ -0,0 +1,6 @@
+sandbox:
+  message: "Feature denied by sandbox policy. Contact platform team."
+
+  deny:
+    sections:
+      - SESSION_VARS