Given a UA Server with three endpoints, a Session has been created.
Is the session strictly tied to one endpoint?
If not, then does a session share all the endpoints User Token Policy? e.g. if a client sends a request with a Policy ID, should the server look for a match by iterating the Policy ID of all the endpoints?
Could you please link some points where this is discussed in the specifications or similar resources?
Yes, the session is created with one endpoint. After that it is activated with one of the user token policies of the endpoint.
Look for CreateSession and ActivateSession in the specifications.