Nit: prefer "positive" assertions when possible, e.g ``if access_token.application_installation.user.is_active:`` (etc)