diff --git a/tests/test_api_tokens.py b/tests/test_api_tokens.py
index b7966b0..68d90f4 100644
--- a/tests/test_api_tokens.py
+++ b/tests/test_api_tokens.py
@@ -13,7 +13,7 @@ from steward.core import api_tokens
 from steward.models.api_tokens import ApiToken
 from steward.models.users import UserRole
 
-V, O, A = UserRole.viewer, UserRole.operator, UserRole.admin
+VW, OP, AD = UserRole.viewer, UserRole.operator, UserRole.admin
 
 
 def test_generated_tokens_are_prefixed_and_unique():
@@ -36,22 +36,22 @@ def test_display_prefix_never_reveals_the_whole_token():
 
 
 @pytest.mark.parametrize("ceiling,user_role,expected", [
-    (A, A, A), (O, A, O), (V, A, V),
-    (A, O, O), (O, O, O), (V, O, V),
-    (A, V, V), (O, V, V), (V, V, V),
+    (AD, AD, AD), (OP, AD, OP), (VW, AD, VW),
+    (AD, OP, OP), (OP, OP, OP), (VW, OP, VW),
+    (AD, VW, VW), (OP, VW, VW), (VW, VW, VW),
 ])
 def test_effective_role_is_the_lower_of_ceiling_and_user(ceiling, user_role, expected):
     assert api_tokens.effective_role(ceiling, user_role) == expected
 
 
 def test_grantable_roles_stop_at_the_users_own():
-    assert api_tokens.grantable_roles(V) == [V]
-    assert api_tokens.grantable_roles(O) == [V, O]
-    assert api_tokens.grantable_roles(A) == [V, O, A]
+    assert api_tokens.grantable_roles(VW) == [VW]
+    assert api_tokens.grantable_roles(OP) == [VW, OP]
+    assert api_tokens.grantable_roles(AD) == [VW, OP, AD]
 
 
 def _token(**kw) -> ApiToken:
-    return ApiToken(name="t", token_hash="x", prefix="stw_x", role=V, **kw)
+    return ApiToken(name="t", token_hash="x", prefix="stw_x", role=VW, **kw)
 
 
 def test_token_state():
@@ -74,25 +74,25 @@ def _fake_db():
 async def test_create_token_stores_only_the_hash():
     db = _fake_db()
     raw, token = await api_tokens.create_token(
-        db, user_id="u1", user_role=O, name="  laptop  ", role=O, expires_in_days=30)
+        db, user_id="u1", user_role=OP, name="  laptop  ", role=OP, expires_in_days=30)
     db.add.assert_called_once_with(token)
     assert token.token_hash == api_tokens.hash_token(raw)
     assert raw not in (token.token_hash, token.prefix)
     assert token.name == "laptop"
-    assert token.role == O
+    assert token.role == OP
     assert token.expires_at is not None
 
 
 async def test_create_token_refuses_a_ceiling_above_the_users_role():
     db = _fake_db()
     with pytest.raises(ValueError, match="higher role"):
-        await api_tokens.create_token(db, user_id="u1", user_role=O, name="x", role=A)
+        await api_tokens.create_token(db, user_id="u1", user_role=OP, name="x", role=AD)
     db.add.assert_not_called()
 
 
 async def test_create_token_requires_a_name():
     with pytest.raises(ValueError, match="name"):
-        await api_tokens.create_token(_fake_db(), user_id="u1", user_role=A, name="  ", role=V)
+        await api_tokens.create_token(_fake_db(), user_id="u1", user_role=AD, name="  ", role=VW)
 
 
 async def test_resolve_rejects_non_steward_tokens_without_touching_the_db():
@@ -127,7 +127,7 @@ async def test_ai_access_refuses_a_disabled_user():
     from steward.ai_access import routes
     from steward.models.users import User
 
-    user = User(id="u1", username="x", email="x@e", password_hash="h", role=A, is_active=False)
+    user = User(id="u1", username="x", email="x@e", password_hash="h", role=AD, is_active=False)
     result = MagicMock()
     result.scalar_one_or_none.return_value = user
     db = MagicMock()