diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/DatabaseClientImplTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/DatabaseClientImplTest.java
index 3a41a469612..9bff8fbc25e 100644
--- a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/DatabaseClientImplTest.java
+++ b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/DatabaseClientImplTest.java
@@ -1457,4 +1457,30 @@ public void testClientIdReusedOnDatabaseNotFound() {
       }
     }
   }
+
+  @Test
+  public void testBatchCreateSessionsPermissionDenied() {
+    mockSpanner.setBatchCreateSessionsExecutionTime(
+        SimulatedExecutionTime.ofStickyException(
+            Status.PERMISSION_DENIED.withDescription("Not permitted").asRuntimeException()));
+    try (Spanner spanner =
+        SpannerOptions.newBuilder()
+            .setProjectId("my-project")
+            .setChannelProvider(channelProvider)
+            .setCredentials(NoCredentials.getInstance())
+            .build()
+            .getService()) {
+      DatabaseId databaseId = DatabaseId.of("my-project", "my-instance", "my-database");
+      DatabaseClient client = spanner.getDatabaseClient(databaseId);
+      // The following call is non-blocking and will not generate an exception.
+      ResultSet rs = client.singleUse().executeQuery(SELECT1);
+      try {
+        // Actually trying to get any results will cause an exception.
+        rs.next();
+        fail("missing PERMISSION_DENIED exception");
+      } catch (SpannerException e) {
+        assertThat(e.getErrorCode()).isEqualTo(ErrorCode.PERMISSION_DENIED);
+      }
+    }
+  }
 }
diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
index 1d64a3dfd4d..63c1560e2f4 100644
--- a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
+++ b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
@@ -38,6 +38,7 @@
 import com.google.cloud.spanner.IntegrationTest;
 import com.google.cloud.spanner.KeySet;
 import com.google.cloud.spanner.Options;
+import com.google.cloud.spanner.ResultSet;
 import com.google.cloud.spanner.SessionPoolOptions;
 import com.google.cloud.spanner.Spanner;
 import com.google.cloud.spanner.SpannerException;
@@ -184,11 +185,15 @@ public void deniedGetDatabase() {
 
   @Test
   public void deniedRead() {
+    // Getting a session and starting a read is non-blocking and will not cause an exception. Trying
+    // to get results from the result set will.
+    ResultSet rs =
+        databaseClient
+            .singleUse()
+            .read("nonexistent-table", KeySet.all(), Arrays.asList("nonexistent-col"));
     try {
       // Tests that the initial create session request returns a permission denied.
-      databaseClient
-          .singleUse()
-          .read("nonexistent-table", KeySet.all(), Arrays.asList("nonexistent-col"));
+      rs.next();
       fail("Expected PERMISSION_DENIED SpannerException");
     } catch (SpannerException e) {
       checkExceptionForVPCError(e);