diff --git a/patrole_tempest_plugin/tests/api/image/test_image_namespace_rbac.py b/patrole_tempest_plugin/tests/api/image/test_image_namespace_rbac.py
index c6bd60e..204263a 100644
--- a/patrole_tempest_plugin/tests/api/image/test_image_namespace_rbac.py
+++ b/patrole_tempest_plugin/tests/api/image/test_image_namespace_rbac.py
@@ -33,10 +33,10 @@
         """
         namespace_name = data_utils.rand_name(
             self.__class__.__name__ + '-test-ns')
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespaces_client.create_namespace(
-            namespace=namespace_name,
-            protected=False)
+        with self.rbac_utils.override_role(self):
+            self.namespaces_client.create_namespace(
+                namespace=namespace_name,
+                protected=False)
         self.addCleanup(
             test_utils.call_and_ignore_notfound_exc,
             self.namespaces_client.delete_namespace,
@@ -50,8 +50,8 @@
 
         RBAC test for the glance get_metadef_namespaces policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespaces_client.list_namespaces()
+        with self.rbac_utils.override_role(self):
+            self.namespaces_client.list_namespaces()
 
     @rbac_rule_validation.action(service="glance",
                                  rule="modify_metadef_namespace")
@@ -66,10 +66,9 @@
         body = self.namespaces_client.create_namespace(
             namespace=namespace_name,
             protected=False)
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespaces_client.update_namespace(body['namespace'],
-                                                description="My new "
-                                                            "description")
+        with self.rbac_utils.override_role(self):
+            self.namespaces_client.update_namespace(
+                body['namespace'], description="My new description")
         self.addCleanup(
             test_utils.call_and_ignore_notfound_exc,
             self.namespaces_client.delete_namespace,
diff --git a/patrole_tempest_plugin/tests/api/image/test_image_namespace_tags_rbac.py b/patrole_tempest_plugin/tests/api/image/test_image_namespace_tags_rbac.py
index ecf2ec2..1a85b74 100644
--- a/patrole_tempest_plugin/tests/api/image/test_image_namespace_tags_rbac.py
+++ b/patrole_tempest_plugin/tests/api/image/test_image_namespace_tags_rbac.py
@@ -69,16 +69,17 @@
     @rbac_rule_validation.action(service="glance",
                                  rule="add_metadef_tag")
     def test_create_namespace_tag(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_namespace_tag()
+        with self.rbac_utils.override_role(self):
+            self._create_namespace_tag()
 
     @decorators.idempotent_id('4acf70cc-05da-4b1e-87b2-d5e4475164e7')
     @rbac_rule_validation.action(service="glance",
                                  rule="get_metadef_tag")
     def test_show_namespace_tag(self):
         tag_name = self._create_namespace_tag()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespace_tags_client.show_namespace_tag(self.namespace, tag_name)
+        with self.rbac_utils.override_role(self):
+            self.namespace_tags_client.show_namespace_tag(self.namespace,
+                                                          tag_name)
 
     @decorators.idempotent_id('01593828-3edb-461e-8abc-8fdeb3927e37')
     @rbac_rule_validation.action(service="glance",
@@ -88,20 +89,20 @@
         updated_tag_name = data_utils.rand_name(
             self.__class__.__name__ + '-tag')
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespace_tags_client.update_namespace_tag(
-            self.namespace, tag_name, name=updated_tag_name)
+        with self.rbac_utils.override_role(self):
+            self.namespace_tags_client.update_namespace_tag(
+                self.namespace, tag_name, name=updated_tag_name)
 
     @decorators.idempotent_id('20ffaf76-ebdc-4267-a1ad-194346f5cc91')
     @rbac_rule_validation.action(service="glance",
                                  rule="add_metadef_tags")
     def test_create_namespace_tags(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_namespace_tag(multiple=True)
+        with self.rbac_utils.override_role(self):
+            self._create_namespace_tag(multiple=True)
 
     @decorators.idempotent_id('d37c1501-e787-449d-89b3-754a942a459a')
     @rbac_rule_validation.action(service="glance",
                                  rule="get_metadef_tags")
     def test_list_namespace_tags(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.namespace_tags_client.list_namespace_tags(self.namespace)
+        with self.rbac_utils.override_role(self):
+            self.namespace_tags_client.list_namespace_tags(self.namespace)
diff --git a/patrole_tempest_plugin/tests/api/image/test_images_rbac.py b/patrole_tempest_plugin/tests/api/image/test_images_rbac.py
index b08f8bd..e97e803 100644
--- a/patrole_tempest_plugin/tests/api/image/test_images_rbac.py
+++ b/patrole_tempest_plugin/tests/api/image/test_images_rbac.py
@@ -24,13 +24,10 @@
 
 class BasicOperationsImagesRbacTest(rbac_base.BaseV2ImageRbacTest):
 
-    credentials = ['primary', 'admin']
-
     @classmethod
     def setup_clients(cls):
         super(BasicOperationsImagesRbacTest, cls).setup_clients()
         cls.image_client = cls.os_primary.image_client_v2
-        cls.admin_image_client = cls.os_admin.image_client_v2
 
     def _create_image(self, **kwargs):
         image_name = data_utils.rand_name(self.__class__.__name__ + '-Image')
@@ -53,8 +50,8 @@
 
         RBAC test for the glance create_image endpoint
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_image()
+        with self.rbac_utils.override_role(self):
+            self._create_image()
 
     @rbac_rule_validation.action(service="glance",
                                  rule="upload_image")
@@ -67,8 +64,8 @@
         """
         image = self._create_image()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._upload_image(image['id'])
+        with self.rbac_utils.override_role(self):
+            self._upload_image(image['id'])
 
     @decorators.idempotent_id('f0c268f3-cb51-49aa-9bd5-d30cf647322f')
     @rbac_rule_validation.action(service="glance",
@@ -82,8 +79,8 @@
         image = self._create_image()
         self._upload_image(image['id'])
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.show_image_file(image['id'])
+        with self.rbac_utils.override_role(self):
+            self.image_client.show_image_file(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="delete_image")
@@ -96,9 +93,9 @@
         """
         image = self._create_image()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.delete_image(image['id'])
-        self.admin_image_client.wait_for_resource_deletion(image['id'])
+        with self.rbac_utils.override_role(self):
+            self.image_client.delete_image(image['id'])
+        self.image_client.wait_for_resource_deletion(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="get_image")
@@ -111,8 +108,8 @@
         """
         image = self._create_image()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.show_image(image['id'])
+        with self.rbac_utils.override_role(self):
+            self.image_client.show_image(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="get_images")
@@ -123,8 +120,8 @@
 
         RBAC test for the glance list_images endpoint
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.list_images()['images']
+        with self.rbac_utils.override_role(self):
+            self.image_client.list_images()['images']
 
     @rbac_rule_validation.action(service="glance",
                                  rule="modify_image")
@@ -137,11 +134,11 @@
         """
         image = self._create_image()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         updated_image_name = data_utils.rand_name(
             self.__class__.__name__ + '-image')
-        self.image_client.update_image(image['id'], [
-            dict(replace='/name', value=updated_image_name)])
+        with self.rbac_utils.override_role(self):
+            self.image_client.update_image(image['id'], [
+                dict(replace='/name', value=updated_image_name)])
 
     @decorators.idempotent_id('244050d9-1b9a-446a-b3c5-f26f3ba8eb75')
     @rbac_rule_validation.action(service="glance",
@@ -154,10 +151,10 @@
         """
         image = self._create_image()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.add_image_tag(
-            image['id'],
-            data_utils.rand_name(self.__class__.__name__ + '-tag'))
+        with self.rbac_utils.override_role(self):
+            self.image_client.add_image_tag(
+                image['id'],
+                data_utils.rand_name(self.__class__.__name__ + '-tag'))
 
     @decorators.idempotent_id('c4a0bf9c-b78b-48c6-a31f-72c95f943c6e')
     @rbac_rule_validation.action(service="glance",
@@ -172,8 +169,8 @@
         tag_name = data_utils.rand_name(self.__class__.__name__ + '-tag')
         self.image_client.add_image_tag(image['id'], tag_name)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.delete_image_tag(image['id'], tag_name)
+        with self.rbac_utils.override_role(self):
+            self.image_client.delete_image_tag(image['id'], tag_name)
 
     @rbac_rule_validation.action(service="glance",
                                  rule="publicize_image")
@@ -184,8 +181,8 @@
 
         RBAC test for the glance publicize_image endpoint
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_image(visibility='public')
+        with self.rbac_utils.override_role(self):
+            self._create_image(visibility='public')
 
     @decorators.idempotent_id('0f2d8427-134a-4d3c-a102-5fcdf5443d09')
     @rbac_rule_validation.action(service="glance",
@@ -196,8 +193,8 @@
 
         RBAC test for the glance communitize_image policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_image(visibility='community')
+        with self.rbac_utils.override_role(self):
+            self._create_image(visibility='community')
 
     @rbac_rule_validation.action(service="glance",
                                  rule="deactivate")
@@ -211,8 +208,8 @@
         image = self._create_image()
         self._upload_image(image['id'])
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.deactivate_image(image['id'])
+        with self.rbac_utils.override_role(self):
+            self.image_client.deactivate_image(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="reactivate")
@@ -226,5 +223,5 @@
         image = self._create_image()
         self._upload_image(image['id'])
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.image_client.reactivate_image(image['id'])
+        with self.rbac_utils.override_role(self):
+            self.image_client.reactivate_image(image['id'])
diff --git a/patrole_tempest_plugin/tests/api/network/test_metering_label_rules_rbac.py b/patrole_tempest_plugin/tests/api/network/test_metering_label_rules_rbac.py
index 5ffc966..7a9d814 100644
--- a/patrole_tempest_plugin/tests/api/network/test_metering_label_rules_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_metering_label_rules_rbac.py
@@ -70,8 +70,8 @@
 
         RBAC test for the neutron create_metering_label_rule policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_metering_label_rule(self.label)
+        with self.rbac_utils.override_role(self):
+            self._create_metering_label_rule(self.label)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_metering_label_rule",
@@ -83,9 +83,9 @@
         RBAC test for the neutron get_metering_label_rule policy
         """
         label_rule = self._create_metering_label_rule(self.label)
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.metering_label_rules_client.show_metering_label_rule(
-            label_rule['id'])
+        with self.rbac_utils.override_role(self):
+            self.metering_label_rules_client.show_metering_label_rule(
+                label_rule['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="delete_metering_label_rule",
@@ -97,6 +97,6 @@
         RBAC test for the neutron delete_metering_label_rule policy
         """
         label_rule = self._create_metering_label_rule(self.label)
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.metering_label_rules_client.delete_metering_label_rule(
-            label_rule['id'])
+        with self.rbac_utils.override_role(self):
+            self.metering_label_rules_client.delete_metering_label_rule(
+                label_rule['id'])
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
index 7c7395b..9c65c14 100644
--- a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
@@ -56,8 +56,8 @@
 
         RBAC test for the neutron create_network:segments policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network_segments()
+        with self.rbac_utils.override_role(self):
+            self._create_network_segments()
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_network:segments")
@@ -70,9 +70,9 @@
         network = self._create_network_segments()
         new_segments = [{"provider:network_type": "gre"}]
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.networks_client.update_network(network['id'],
-                                            segments=new_segments)
+        with self.rbac_utils.override_role(self):
+            self.networks_client.update_network(network['id'],
+                                                segments=new_segments)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_network:segments")
@@ -84,9 +84,9 @@
         """
         network = self._create_network_segments()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        body = self.networks_client.show_network(network['id'],
-                                                 fields='segments')
+        with self.rbac_utils.override_role(self):
+            body = self.networks_client.show_network(network['id'],
+                                                     fields='segments')
         response_network = body['network']
 
         # If user does not have access to the network segments attribute,
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
index e0cf098..84ce2c7 100644
--- a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
@@ -95,8 +95,8 @@
 
         RBAC test for the neutron create_network policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network()
+        with self.rbac_utils.override_role(self):
+            self._create_network()
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_network:shared")
@@ -107,8 +107,8 @@
 
         RBAC test for the neutron create_network:shared policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network(shared=True)
+        with self.rbac_utils.override_role(self):
+            self._create_network(shared=True)
 
     @utils.requires_ext(extension='external-net', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -120,8 +120,8 @@
 
         RBAC test for the neutron create_network:router:external policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network(router_external=True)
+        with self.rbac_utils.override_role(self):
+            self._create_network(router_external=True)
 
     @utils.requires_ext(extension='provider', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -133,8 +133,8 @@
 
         RBAC test for the neutron create_network:provider:network_type policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network(provider_network_type='vxlan')
+        with self.rbac_utils.override_role(self):
+            self._create_network(provider_network_type='vxlan')
 
     @utils.requires_ext(extension='provider', service='network')
     @rbac_rule_validation.action(
@@ -147,9 +147,9 @@
 
         RBAC test for the neutron create_network:provider:segmentation_id
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_network(provider_network_type='vxlan',
-                             provider_segmentation_id=200)
+        with self.rbac_utils.override_role(self):
+            self._create_network(provider_network_type='vxlan',
+                                 provider_segmentation_id=200)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_network")
@@ -163,8 +163,8 @@
         updated_name = data_utils.rand_name(
             self.__class__.__name__ + '-Network')
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._update_network(name=updated_name)
+        with self.rbac_utils.override_role(self):
+            self._update_network(name=updated_name)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_network:shared")
@@ -175,8 +175,8 @@
 
         RBAC test for the neutron update_network:shared policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._update_network(shared_network=True)
+        with self.rbac_utils.override_role(self):
+            self._update_network(shared_network=True)
         self.addCleanup(self._update_network, shared_network=False)
 
     @utils.requires_ext(extension='external-net', service='network')
@@ -190,8 +190,8 @@
         RBAC test for the neutron update_network:router:external policy
         """
         network = self._create_network()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._update_network(net_id=network['id'], router_external=True)
+        with self.rbac_utils.override_role(self):
+            self._update_network(net_id=network['id'], router_external=True)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_network")
@@ -202,8 +202,8 @@
 
         RBAC test for the neutron get_network policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.networks_client.show_network(self.network['id'])
+        with self.rbac_utils.override_role(self):
+            self.networks_client.show_network(self.network['id'])
 
     @utils.requires_ext(extension='external-net', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -217,9 +217,9 @@
         """
         kwargs = {'fields': 'router:external'}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.networks_client.show_network(self.network['id'],
-                                          **kwargs)
+        with self.rbac_utils.override_role(self):
+            self.networks_client.show_network(self.network['id'],
+                                              **kwargs)
 
     @utils.requires_ext(extension='provider', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -233,9 +233,9 @@
         """
         kwargs = {'fields': 'provider:network_type'}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        retrieved_network = self.networks_client.show_network(
-            self.network['id'], **kwargs)['network']
+        with self.rbac_utils.override_role(self):
+            retrieved_network = self.networks_client.show_network(
+                self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
             raise rbac_exceptions.RbacMalformedResponse(True)
@@ -252,9 +252,9 @@
         """
         kwargs = {'fields': 'provider:physical_network'}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        retrieved_network = self.networks_client.show_network(
-            self.network['id'], **kwargs)['network']
+        with self.rbac_utils.override_role(self):
+            retrieved_network = self.networks_client.show_network(
+                self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
             raise rbac_exceptions.RbacMalformedResponse(empty=True)
@@ -271,9 +271,9 @@
         """
         kwargs = {'fields': 'provider:segmentation_id'}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        retrieved_network = self.networks_client.show_network(
-            self.network['id'], **kwargs)['network']
+        with self.rbac_utils.override_role(self):
+            retrieved_network = self.networks_client.show_network(
+                self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
             raise rbac_exceptions.RbacMalformedResponse(empty=True)
@@ -291,8 +291,8 @@
         RBAC test for the neutron delete_network policy
         """
         network = self._create_network()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.networks_client.delete_network(network['id'])
+        with self.rbac_utils.override_role(self):
+            self.networks_client.delete_network(network['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_subnet")
@@ -305,8 +305,8 @@
         """
         network = self._create_network()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_subnet(network, enable_dhcp=False)
+        with self.rbac_utils.override_role(self):
+            self.create_subnet(network, enable_dhcp=False)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_subnet")
@@ -317,8 +317,8 @@
 
         RBAC test for the neutron get_subnet policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.subnets_client.show_subnet(self.subnet['id'])
+        with self.rbac_utils.override_role(self):
+            self.subnets_client.show_subnet(self.subnet['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_subnet")
@@ -332,9 +332,9 @@
         updated_name = data_utils.rand_name(
             self.__class__.__name__ + '-Network')
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.subnets_client.update_subnet(self.subnet['id'],
-                                          name=updated_name)
+        with self.rbac_utils.override_role(self):
+            self.subnets_client.update_subnet(self.subnet['id'],
+                                              name=updated_name)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="delete_subnet")
@@ -348,8 +348,8 @@
         network = self._create_network()
         subnet = self.create_subnet(network, enable_dhcp=False)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.subnets_client.delete_subnet(subnet['id'])
+        with self.rbac_utils.override_role(self):
+            self.subnets_client.delete_subnet(subnet['id'])
 
     @utils.requires_ext(extension='dhcp_agent_scheduler', service='network')
     @decorators.idempotent_id('b524f19f-fbb4-4d11-a85d-03bfae17bf0e')
@@ -361,6 +361,6 @@
 
         RBAC test for the neutron "get_dhcp-agents" policy
         """
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.networks_client.list_dhcp_agents_on_hosting_network(
-            self.network['id'])
+        with self.rbac_utils.override_role(self):
+            self.networks_client.list_dhcp_agents_on_hosting_network(
+                self.network['id'])
diff --git a/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py b/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
index c55935f..0b91e14 100644
--- a/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
@@ -62,22 +62,23 @@
     @decorators.idempotent_id('0ec8c551-625c-4864-8a52-85baa7c40f22')
     def test_create_port(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(self.network)
+        with self.rbac_utils.override_role(self):
+            self.create_port(self.network)
 
     @decorators.idempotent_id('045ee797-4962-4913-b96a-5d7ea04099e7')
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_port:device_owner")
     def test_create_port_device_owner(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(self.network, device_owner='network:router_interface')
+        with self.rbac_utils.override_role(self):
+            self.create_port(self.network,
+                             device_owner='network:router_interface')
 
     @decorators.idempotent_id('c4fa8844-f5ef-4daa-bfa2-b89897dfaedf')
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_port:port_security_enabled")
     def test_create_port_security_enabled(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(self.network, port_security_enabled=True)
+        with self.rbac_utils.override_role(self):
+            self.create_port(self.network, port_security_enabled=True)
 
     @utils.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -88,8 +89,8 @@
         post_body = {'network': self.network,
                      'binding:host_id': "rbac_test_host"}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(**post_body)
+        with self.rbac_utils.override_role(self):
+            self.create_port(**post_body)
 
     @utils.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -102,8 +103,8 @@
         post_body = {'network': self.network,
                      'binding:profile': binding_profile}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(**post_body)
+        with self.rbac_utils.override_role(self):
+            self.create_port(**post_body)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_port:fixed_ips:ip_address")
@@ -117,8 +118,8 @@
         post_body = {'network': self.network,
                      'fixed_ips': fixed_ips}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(**post_body)
+        with self.rbac_utils.override_role(self):
+            self.create_port(**post_body)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_port:mac_address")
@@ -128,8 +129,8 @@
         post_body = {'network': self.network,
                      'mac_address': data_utils.rand_mac_address()}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(**post_body)
+        with self.rbac_utils.override_role(self):
+            self.create_port(**post_body)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_port:allowed_address_pairs")
@@ -143,16 +144,16 @@
         post_body = {'network': self.network,
                      'allowed_address_pairs': allowed_address_pairs}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_port(**post_body)
+        with self.rbac_utils.override_role(self):
+            self.create_port(**post_body)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_port",
                                  expected_error_code=404)
     @decorators.idempotent_id('a9d41cb8-78a2-4b97-985c-44e4064416f4')
     def test_show_port(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.show_port(self.port['id'])
+        with self.rbac_utils.override_role(self):
+            self.ports_client.show_port(self.port['id'])
 
     @utils.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -163,10 +164,9 @@
         # Verify specific fields of a port
         fields = ['binding:vif_type']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-
-        retrieved_port = self.ports_client.show_port(
-            self.port['id'], fields=fields)['port']
+        with self.rbac_utils.override_role(self):
+            retrieved_port = self.ports_client.show_port(
+                self.port['id'], fields=fields)['port']
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
@@ -182,10 +182,9 @@
         # Verify specific fields of a port
         fields = ['binding:vif_details']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-
-        retrieved_port = self.ports_client.show_port(
-            self.port['id'], fields=fields)['port']
+        with self.rbac_utils.override_role(self):
+            retrieved_port = self.ports_client.show_port(
+                self.port['id'], fields=fields)['port']
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
@@ -204,9 +203,9 @@
                      'binding:host_id': data_utils.rand_name('host-id')}
         port = self.create_port(**post_body)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        retrieved_port = self.ports_client.show_port(
-            port['id'], fields=fields)['port']
+        with self.rbac_utils.override_role(self):
+            retrieved_port = self.ports_client.show_port(
+                port['id'], fields=fields)['port']
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
@@ -226,9 +225,9 @@
                      'binding:profile': binding_profile}
         port = self.create_port(**post_body)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        retrieved_port = self.ports_client.show_port(
-            port['id'], fields=fields)['port']
+        with self.rbac_utils.override_role(self):
+            retrieved_port = self.ports_client.show_port(
+                port['id'], fields=fields)['port']
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
@@ -239,8 +238,9 @@
                                  rule="update_port")
     @decorators.idempotent_id('afa80981-3c59-42fd-9531-3bcb2cd03711')
     def test_update_port(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(self.port['id'], admin_state_up=False)
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(self.port['id'],
+                                          admin_state_up=False)
         self.addCleanup(self.ports_client.update_port, self.port['id'],
                         admin_state_up=True)
 
@@ -250,9 +250,9 @@
     def test_update_port_device_owner(self):
         original_device_owner = self.port['device_owner']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(
-            self.port['id'], device_owner='network:router_interface')
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(
+                self.port['id'], device_owner='network:router_interface')
         self.addCleanup(self.ports_client.update_port, self.port['id'],
                         device_owner=original_device_owner)
 
@@ -262,9 +262,9 @@
     def test_update_port_mac_address(self):
         original_mac_address = self.port['mac_address']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(
-            self.port['id'], mac_address=data_utils.rand_mac_address())
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(
+                self.port['id'], mac_address=data_utils.rand_mac_address())
         self.addCleanup(self.ports_client.update_port, self.port['id'],
                         mac_address=original_mac_address)
 
@@ -280,15 +280,15 @@
         ip_list = self._get_unused_ip_address()
         fixed_ips = [{'ip_address': ip_list[0]}]
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(port['id'], fixed_ips=fixed_ips)
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(port['id'], fixed_ips=fixed_ips)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_port:port_security_enabled")
     @decorators.idempotent_id('795541af-6652-4e35-9581-fd58224f7545')
     def test_update_port_security_enabled(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(self.port['id'], security_groups=[])
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(self.port['id'], security_groups=[])
 
     @utils.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -303,8 +303,8 @@
         updated_body = {'port_id': port['id'],
                         'binding:host_id': 'rbac_test_host_updated'}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(**updated_body)
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(**updated_body)
 
     @utils.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -322,8 +322,8 @@
         updated_body = {'port_id': port['id'],
                         'binding:profile': new_binding_profile}
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(**updated_body)
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(**updated_body)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_port:allowed_address_pairs")
@@ -337,9 +337,9 @@
         post_body = {'network': self.network}
         port = self.create_port(**post_body)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.update_port(port['id'],
-                                      allowed_address_pairs=address_pairs)
+        with self.rbac_utils.override_role(self):
+            self.ports_client.update_port(port['id'],
+                                          allowed_address_pairs=address_pairs)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="delete_port",
@@ -348,5 +348,5 @@
     def test_delete_port(self):
 
         port = self.create_port(self.network)
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.ports_client.delete_port(port['id'])
+        with self.rbac_utils.override_role(self):
+            self.ports_client.delete_port(port['id'])
diff --git a/patrole_tempest_plugin/tests/api/network/test_security_groups_rbac.py b/patrole_tempest_plugin/tests/api/network/test_security_groups_rbac.py
index 3ed23fd..aaba1d2 100644
--- a/patrole_tempest_plugin/tests/api/network/test_security_groups_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_security_groups_rbac.py
@@ -73,8 +73,8 @@
     @decorators.idempotent_id('db7003ce-5717-4e5b-afc7-befa35e8c67f')
     def test_create_security_group(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_security_group()
+        with self.rbac_utils.override_role(self):
+            self._create_security_group()
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_security_group",
@@ -82,9 +82,9 @@
     @decorators.idempotent_id('56335e77-aef2-4b54-86c7-7f772034b585')
     def test_show_security_groups(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_groups_client.show_security_group(
-            self.secgroup['id'])
+        with self.rbac_utils.override_role(self):
+            self.security_groups_client.show_security_group(
+                self.secgroup['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="delete_security_group",
@@ -95,8 +95,8 @@
         # Create a security group
         secgroup_id = self._create_security_group()['id']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_groups_client.delete_security_group(secgroup_id)
+        with self.rbac_utils.override_role(self):
+            self.security_groups_client.delete_security_group(secgroup_id)
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_security_group",
@@ -107,26 +107,26 @@
         # Create a security group
         secgroup_id = self._create_security_group()['id']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_groups_client.update_security_group(
-            secgroup_id,
-            description="test description")
+        with self.rbac_utils.override_role(self):
+            self.security_groups_client.update_security_group(
+                secgroup_id,
+                description="test description")
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_security_groups")
     @decorators.idempotent_id('fbaf8d96-ed3e-49af-b24c-5fb44f05bbb7')
     def test_list_security_groups(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_groups_client.list_security_groups()
+        with self.rbac_utils.override_role(self):
+            self.security_groups_client.list_security_groups()
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="create_security_group_rule")
     @decorators.idempotent_id('953d78df-00cd-416f-9cbd-b7cb4ea65772')
     def test_create_security_group_rule(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_security_group_rule()
+        with self.rbac_utils.override_role(self):
+            self._create_security_group_rule()
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="delete_security_group_rule",
@@ -135,9 +135,9 @@
     def test_delete_security_group_rule(self):
 
         sec_group_rule = self._create_security_group_rule()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_group_rules_client.delete_security_group_rule(
-            sec_group_rule['id'])
+        with self.rbac_utils.override_role(self):
+            self.security_group_rules_client.delete_security_group_rule(
+                sec_group_rule['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_security_group_rule",
@@ -146,14 +146,14 @@
     def test_show_security_group_rule(self):
 
         sec_group_rule = self._create_security_group_rule()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_group_rules_client.show_security_group_rule(
-            sec_group_rule['id'])
+        with self.rbac_utils.override_role(self):
+            self.security_group_rules_client.show_security_group_rule(
+                sec_group_rule['id'])
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="get_security_group_rules")
     @decorators.idempotent_id('05739ab6-fa35-11e6-bc64-92361f002671')
     def test_list_security_group_rules(self):
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.security_group_rules_client.list_security_group_rules()
+        with self.rbac_utils.override_role(self):
+            self.security_group_rules_client.list_security_group_rules()
diff --git a/patrole_tempest_plugin/tests/api/volume/test_limits_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_limits_rbac.py
index fa92cad..976d756 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_limits_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_limits_rbac.py
@@ -26,5 +26,5 @@
     @rbac_rule_validation.action(service="cinder",
                                  rule="limits_extension:used_limits")
     def test_show_limits(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.volume_limits_client.show_limits()
+        with self.rbac_utils.override_role(self):
+            self.volume_limits_client.show_limits()
diff --git a/patrole_tempest_plugin/tests/api/volume/test_qos_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_qos_rbac.py
index adfd397..a62bbda 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_qos_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_qos_rbac.py
@@ -23,13 +23,11 @@
 
 
 class VolumeQOSV3RbacTest(rbac_base.BaseVolumeRbacTest):
-    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
         super(VolumeQOSV3RbacTest, cls).setup_clients()
         cls.qos_client = cls.os_primary.volume_qos_v2_client
-        cls.admin_qos_client = cls.os_admin.volume_qos_v2_client
 
     def _create_test_qos_specs(self, name=None, consumer=None, **kwargs):
         name = name or data_utils.rand_name(self.__class__.__name__ + '-QoS')
@@ -44,24 +42,24 @@
         service="cinder", rule="volume_extension:qos_specs_manage:create")
     @decorators.idempotent_id('4f9f45f0-b379-4577-a279-cec3e917cbec')
     def test_create_qos_with_consumer(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_test_qos_specs()
+        with self.rbac_utils.override_role(self):
+            self._create_test_qos_specs()
 
     @rbac_rule_validation.action(
         service="cinder", rule="volume_extension:qos_specs_manage:delete")
     @decorators.idempotent_id('fbc8a77e-6b6d-45ae-bebe-c496eb8f06f7')
     def test_delete_qos_with_consumer(self):
         qos = self._create_test_qos_specs()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.delete_qos(qos['id'])
+        with self.rbac_utils.override_role(self):
+            self.qos_client.delete_qos(qos['id'])
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume_extension:qos_specs_manage:get")
     @decorators.idempotent_id('22aff0dd-0343-408d-ae80-e77551956e14')
     def test_show_qos(self):
         qos = self._create_test_qos_specs()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.show_qos(qos['id'])['qos_specs']
+        with self.rbac_utils.override_role(self):
+            self.qos_client.show_qos(qos['id'])['qos_specs']
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume_extension:"
@@ -73,24 +71,25 @@
         self.qos_client.associate_qos(qos['id'], vol_type)
         self.addCleanup(self.qos_client.disassociate_qos, qos['id'], vol_type)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.show_association_qos(qos['id'])
+        with self.rbac_utils.override_role(self):
+            self.qos_client.show_association_qos(qos['id'])
 
     @rbac_rule_validation.action(
         service="cinder",
         rule="volume_extension:qos_specs_manage:get_all")
     @decorators.idempotent_id('546b8bb1-04a4-4387-9506-a538a7f3cd6a')
     def test_list_qos(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.list_qos()['qos_specs']
+        with self.rbac_utils.override_role(self):
+            self.qos_client.list_qos()['qos_specs']
 
     @rbac_rule_validation.action(
         service="cinder", rule="volume_extension:qos_specs_manage:update")
     @decorators.idempotent_id('89b630b7-c170-47c3-ac80-50ed425c2d98')
     def test_set_qos_key(self):
         qos = self._create_test_qos_specs()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.set_qos_key(qos['id'], iops_bytes='500')['qos_specs']
+        with self.rbac_utils.override_role(self):
+            self.qos_client.set_qos_key(
+                qos['id'], iops_bytes='500')['qos_specs']
 
     @rbac_rule_validation.action(
         service="cinder", rule="volume_extension:qos_specs_manage:update")
@@ -99,9 +98,9 @@
         qos = self._create_test_qos_specs()
         self.qos_client.set_qos_key(qos['id'], iops_bytes='500')['qos_specs']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.unset_qos_key(qos['id'], ['iops_bytes'])
-        waiters.wait_for_qos_operations(self.admin_qos_client, qos['id'],
+        with self.rbac_utils.override_role(self):
+            self.qos_client.unset_qos_key(qos['id'], ['iops_bytes'])
+        waiters.wait_for_qos_operations(self.qos_client, qos['id'],
                                         'qos-key-unset', args=['iops_bytes'])
 
     @rbac_rule_validation.action(
@@ -111,8 +110,8 @@
         qos = self._create_test_qos_specs()
         vol_type = self.create_volume_type()['id']
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.associate_qos(qos['id'], vol_type)
+        with self.rbac_utils.override_role(self):
+            self.qos_client.associate_qos(qos['id'], vol_type)
         self.addCleanup(
             test_utils.call_and_ignore_notfound_exc,
             self.qos_client.disassociate_qos, qos['id'], vol_type)
@@ -127,9 +126,9 @@
         self.addCleanup(test_utils.call_and_ignore_notfound_exc,
                         self.qos_client.disassociate_qos, qos['id'], vol_type)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.disassociate_qos(qos['id'], vol_type)
-        waiters.wait_for_qos_operations(self.admin_qos_client, qos['id'],
+        with self.rbac_utils.override_role(self):
+            self.qos_client.disassociate_qos(qos['id'], vol_type)
+        waiters.wait_for_qos_operations(self.qos_client, qos['id'],
                                         'disassociate', args=vol_type)
 
     @rbac_rule_validation.action(
@@ -142,7 +141,7 @@
         self.addCleanup(test_utils.call_and_ignore_notfound_exc,
                         self.qos_client.disassociate_qos, qos['id'], vol_type)
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.qos_client.disassociate_all_qos(qos['id'])
-        waiters.wait_for_qos_operations(self.admin_qos_client, qos['id'],
+        with self.rbac_utils.override_role(self):
+            self.qos_client.disassociate_all_qos(qos['id'])
+        waiters.wait_for_qos_operations(self.qos_client, qos['id'],
                                         'disassociate-all')
diff --git a/patrole_tempest_plugin/tests/api/volume/test_quota_classes_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_quota_classes_rbac.py
index a81f1b9..dace257 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_quota_classes_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_quota_classes_rbac.py
@@ -41,9 +41,9 @@
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume_extension:quota_classes")
     def test_show_quota_class_set(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.quota_classes_client.show_quota_class_set(
-            self.quota_name)['quota_class_set']
+        with self.rbac_utils.override_role(self):
+            self.quota_classes_client.show_quota_class_set(
+                self.quota_name)['quota_class_set']
 
     @decorators.idempotent_id('72159478-23a7-4c75-989f-6bac609eca62')
     @rbac_rule_validation.action(service="cinder",
@@ -53,6 +53,6 @@
             self.quota_name)['quota_class_set']
         quota_class_set.pop('id')
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.quota_classes_client.update_quota_class_set(self.quota_name,
-                                                         **quota_class_set)
+        with self.rbac_utils.override_role(self):
+            self.quota_classes_client.update_quota_class_set(self.quota_name,
+                                                             **quota_class_set)
diff --git a/patrole_tempest_plugin/tests/api/volume/test_scheduler_stats_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_scheduler_stats_rbac.py
index 8fded0a..a243587 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_scheduler_stats_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_scheduler_stats_rbac.py
@@ -40,5 +40,5 @@
         rule="scheduler_extension:scheduler_stats:get_pools")
     @decorators.idempotent_id('5f800441-4d30-48ec-9e5b-0d55bc86acbb')
     def test_list_back_end_storage_pools(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.scheduler_stats_client.list_pools()
+        with self.rbac_utils.override_role(self):
+            self.scheduler_stats_client.list_pools()
diff --git a/patrole_tempest_plugin/tests/api/volume/test_snapshots_actions_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_snapshots_actions_rbac.py
index f7a4151..65b7526 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_snapshots_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_snapshots_actions_rbac.py
@@ -66,8 +66,8 @@
     def test_snapshot_force_delete(self):
         temp_snapshot = self.create_snapshot(self.volume['id'])
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.snapshots_client.force_delete_snapshot(temp_snapshot['id'])
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.force_delete_snapshot(temp_snapshot['id'])
         self.snapshots_client.wait_for_resource_deletion(temp_snapshot['id'])
 
     @decorators.idempotent_id('a95eab2a-c441-4609-9235-f7478627da88')
diff --git a/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
index 1f82671..226411f 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_snapshots_metadata_rbac.py
@@ -53,8 +53,8 @@
     @decorators.idempotent_id('c9cbec1c-edfe-46b8-825b-7b6ac0a58c25')
     def test_create_snapshot_metadata(self):
         # Create metadata for the snapshot
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self._create_test_snapshot_metadata()
+        with self.rbac_utils.override_role(self):
+            self._create_test_snapshot_metadata()
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:get_snapshot_metadata")
@@ -63,9 +63,9 @@
         # Create volume and snapshot metadata
         self._create_test_snapshot_metadata()
         # Get metadata for the snapshot
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.snapshots_client.show_snapshot_metadata(
-            self.snapshot_id)
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.show_snapshot_metadata(
+                self.snapshot_id)
 
     @rbac_rule_validation.action(
         service="cinder",
@@ -74,31 +74,30 @@
     def test_get_snapshot_metadata_for_volume_tenant(self):
         # Create volume and snapshot metadata
         self._create_test_snapshot_metadata()
-        # Get metadata for the snapshot
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         # Get the metadata of the snapshot
-        self.snapshots_client.show_snapshot_metadata(
-            self.snapshot_id)['metadata']
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.show_snapshot_metadata(
+                self.snapshot_id)['metadata']
 
     @decorators.idempotent_id('7ea597f6-c544-4b10-aab0-ff68f595fb06')
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:update_snapshot_metadata")
     def test_update_snapshot_metadata(self):
         self._create_test_snapshot_metadata()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        update = {"key3": "value3_update",
-                  "key4": "value4"}
-        self.snapshots_client.update_snapshot_metadata(
-            self.snapshot['id'], metadata=update)
+        with self.rbac_utils.override_role(self):
+            update = {"key3": "value3_update",
+                      "key4": "value4"}
+            self.snapshots_client.update_snapshot_metadata(
+                self.snapshot['id'], metadata=update)
 
     @decorators.idempotent_id('93068d02-0131-4dd3-af16-fc40d7128d93')
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:get_snapshot_metadata")
     def test_show_snapshot_metadata_item(self):
         self._create_test_snapshot_metadata()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.snapshots_client.show_snapshot_metadata_item(
-            self.snapshot['id'], "key3")['meta']
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.show_snapshot_metadata_item(
+                self.snapshot['id'], "key3")['meta']
 
     @decorators.idempotent_id('1f8f43e7-da31-4128-bb3c-73fc548650e3')
     @rbac_rule_validation.action(service="cinder",
@@ -106,15 +105,15 @@
     def test_update_snapshot_metadata_item(self):
         update_item = {"key3": "value3_update"}
         self._create_test_snapshot_metadata()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.snapshots_client.update_snapshot_metadata_item(
-            self.snapshot['id'], "key3", meta=update_item)['meta']
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.update_snapshot_metadata_item(
+                self.snapshot['id'], "key3", meta=update_item)['meta']
 
     @decorators.idempotent_id('3ec32516-f7cd-4f88-b78a-ddee67492071')
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:delete_snapshot_metadata")
     def test_delete_snapshot_metadata_item(self):
         self._create_test_snapshot_metadata()
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.snapshots_client.delete_snapshot_metadata_item(
-            self.snapshot['id'], "key1")
+        with self.rbac_utils.override_role(self):
+            self.snapshots_client.delete_snapshot_metadata_item(
+                self.snapshot['id'], "key1")
diff --git a/patrole_tempest_plugin/tests/api/volume/test_user_messages_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_user_messages_rbac.py
index bac9189..56ee1e0 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_user_messages_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_user_messages_rbac.py
@@ -28,13 +28,10 @@
     min_microversion = '3.3'
     max_microversion = 'latest'
 
-    credentials = ['primary', 'admin']
-
     @classmethod
     def setup_clients(cls):
         super(MessagesV3RbacTest, cls).setup_clients()
         cls.messages_client = cls.os_primary.volume_v3_messages_client
-        cls.admin_messages_client = cls.os_admin.volume_v3_messages_client
 
     def _create_user_message(self):
         """Trigger a 'no valid host' situation to generate a message."""
@@ -70,8 +67,8 @@
         service="cinder",
         rule="message:get_all")
     def test_list_messages(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.messages_client.list_messages()['messages']
+        with self.rbac_utils.override_role(self):
+            self.messages_client.list_messages()['messages']
 
     @decorators.idempotent_id('9cc1ad1e-68a2-4407-8b60-ea77909bce08')
     @rbac_rule_validation.action(
@@ -80,8 +77,8 @@
     def test_show_message(self):
         message_id = self._create_user_message()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.messages_client.show_message(message_id)['message']
+        with self.rbac_utils.override_role(self):
+            self.messages_client.show_message(message_id)['message']
 
     @decorators.idempotent_id('65ca7fb7-7f2c-443e-b144-ac86973a97be')
     @rbac_rule_validation.action(
@@ -90,6 +87,6 @@
     def test_delete_message(self):
         message_id = self._create_user_message()
 
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.messages_client.delete_message(message_id)
-        self.admin_messages_client.wait_for_resource_deletion(message_id)
+        with self.rbac_utils.override_role(self):
+            self.messages_client.delete_message(message_id)
+        self.messages_client.wait_for_resource_deletion(message_id)
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_services_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_services_rbac.py
index d36fb5a..1711c88 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_services_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_services_rbac.py
@@ -43,5 +43,5 @@
         service="cinder",
         rule="volume_extension:services:index")
     def test_list_services(self):
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.services_client.list_services()['services']
+        with self.rbac_utils.override_role(self):
+            self.services_client.list_services()['services']
diff --git a/requirements.txt b/requirements.txt
index 4f51720..f675e4d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,7 +3,7 @@
 # process, which may cause wedges in the gate later.
 hacking>=1.0.0 # Apache-2.0
 pbr!=2.1.0,>=2.0.0 # Apache-2.0
-oslo.log>=3.30.0 # Apache-2.0
+oslo.log>=3.36.0 # Apache-2.0
 oslo.config>=5.1.0 # Apache-2.0
 oslo.policy>=1.30.0 # Apache-2.0
 tempest>=17.1.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 47d6819..abe2b2c 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -11,7 +11,7 @@
 coverage!=4.4,>=4.0 # Apache-2.0
 nose>=1.3.7 # LGPL
 nosexcover>=1.0.10 # BSD
-oslotest>=1.10.0 # Apache-2.0
+oslotest>=3.2.0 # Apache-2.0
 oslo.policy>=1.30.0 # Apache-2.0
-oslo.log>=3.30.0 # Apache-2.0
+oslo.log>=3.36.0 # Apache-2.0
 tempest>=17.1.0 # Apache-2.0