diff --git a/.coveragerc b/.coveragerc
index 18d6f22..52890ec 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -2,7 +2,6 @@
 branch = True
 
 [report]
-fail_under = 100
 show_missing = True
 omit =
     google/cloud/orgpolicy/__init__.py
diff --git a/.github/.OwlBot.lock.yaml b/.github/.OwlBot.lock.yaml
index 864c176..e2b39f9 100644
--- a/.github/.OwlBot.lock.yaml
+++ b/.github/.OwlBot.lock.yaml
@@ -1,3 +1,3 @@
 docker:
   image: gcr.io/repo-automation-bots/owlbot-python:latest
-  digest: sha256:4c981a6b6f2b8914a448d7b3a01688365be03e3ed26dfee399a6aa77fb112eaa
+  digest: sha256:99d90d097e4a4710cc8658ee0b5b963f4426d0e424819787c3ac1405c9a26719
diff --git a/.kokoro/samples/python3.9/common.cfg b/.kokoro/samples/python3.9/common.cfg
new file mode 100644
index 0000000..f70a7c1
--- /dev/null
+++ b/.kokoro/samples/python3.9/common.cfg
@@ -0,0 +1,40 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Build logs will be here
+action {
+  define_artifacts {
+    regex: "**/*sponge_log.xml"
+  }
+}
+
+# Specify which tests to run
+env_vars: {
+    key: "RUN_TESTS_SESSION"
+    value: "py-3.9"
+}
+
+# Declare build specific Cloud project.
+env_vars: {
+    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
+    value: "python-docs-samples-tests-py39"
+}
+
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/python-org-policy/.kokoro/test-samples.sh"
+}
+
+# Configure the docker image for kokoro-trampoline.
+env_vars: {
+    key: "TRAMPOLINE_IMAGE"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+}
+
+# Download secrets for samples
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
+
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
+
+# Use the trampoline script to run in docker.
+build_file: "python-org-policy/.kokoro/trampoline.sh"
\ No newline at end of file
diff --git a/.kokoro/samples/python3.9/continuous.cfg b/.kokoro/samples/python3.9/continuous.cfg
new file mode 100644
index 0000000..a1c8d97
--- /dev/null
+++ b/.kokoro/samples/python3.9/continuous.cfg
@@ -0,0 +1,6 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+env_vars: {
+    key: "INSTALL_LIBRARY_FROM_SOURCE"
+    value: "True"
+}
\ No newline at end of file
diff --git a/.kokoro/samples/python3.9/periodic-head.cfg b/.kokoro/samples/python3.9/periodic-head.cfg
new file mode 100644
index 0000000..f9cfcd3
--- /dev/null
+++ b/.kokoro/samples/python3.9/periodic-head.cfg
@@ -0,0 +1,11 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+env_vars: {
+    key: "INSTALL_LIBRARY_FROM_SOURCE"
+    value: "True"
+}
+
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/python-pubsub/.kokoro/test-samples-against-head.sh"
+}
diff --git a/.kokoro/samples/python3.9/periodic.cfg b/.kokoro/samples/python3.9/periodic.cfg
new file mode 100644
index 0000000..50fec96
--- /dev/null
+++ b/.kokoro/samples/python3.9/periodic.cfg
@@ -0,0 +1,6 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+env_vars: {
+    key: "INSTALL_LIBRARY_FROM_SOURCE"
+    value: "False"
+}
\ No newline at end of file
diff --git a/.kokoro/samples/python3.9/presubmit.cfg b/.kokoro/samples/python3.9/presubmit.cfg
new file mode 100644
index 0000000..a1c8d97
--- /dev/null
+++ b/.kokoro/samples/python3.9/presubmit.cfg
@@ -0,0 +1,6 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+env_vars: {
+    key: "INSTALL_LIBRARY_FROM_SOURCE"
+    value: "True"
+}
\ No newline at end of file
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4f00c7c..62eb5a7 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -16,7 +16,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+    rev: v4.0.1
     hooks:
     -   id: trailing-whitespace
     -   id: end-of-file-fixer
diff --git a/.repo-metadata.json b/.repo-metadata.json
index 25a6bc0..544ecba 100644
--- a/.repo-metadata.json
+++ b/.repo-metadata.json
@@ -4,7 +4,7 @@
     "product_documentation": "https://cloud.google.com/resource-manager/docs/organization-policy/overview",
     "client_documentation": "https://googleapis.dev/python/orgpolicy/latest",
     "issue_tracker": "",
-    "release_level": "beta",
+    "release_level": "ga",
     "language": "python",
     "library_type": "GAPIC_AUTO",
     "repo": "googleapis/python-org-policy",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 775c7cc..54c7fa6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.0.0](https://www.github.com/googleapis/python-org-policy/compare/v0.3.0...v1.0.0) (2021-07-01)
+
+
+### Features
+
+* add always_use_jwt_access ([#59](https://www.github.com/googleapis/python-org-policy/issues/59)) ([6acf334](https://www.github.com/googleapis/python-org-policy/commit/6acf334ca0c306603b49ab64694647985b04e83b))
+* bump release level to production/stable ([#50](https://www.github.com/googleapis/python-org-policy/issues/50)) ([2b1da9e](https://www.github.com/googleapis/python-org-policy/commit/2b1da9e03aa82330b0461c78abee2fa75390d238))
+
+
+### Bug Fixes
+
+* disable always_use_jwt_access ([#62](https://www.github.com/googleapis/python-org-policy/issues/62)) ([b6bf93c](https://www.github.com/googleapis/python-org-policy/commit/b6bf93c535dee1822d3b111a8e96ca6d4d30ba55))
+
+
+### Documentation
+
+* omit mention of Python 2.7 in 'CONTRIBUTING.rst' ([#1127](https://www.github.com/googleapis/python-org-policy/issues/1127)) ([#56](https://www.github.com/googleapis/python-org-policy/issues/56)) ([540f601](https://www.github.com/googleapis/python-org-policy/commit/540f6018e9631664c0fda97ca1d0db90ab5783fd)), closes [#1126](https://www.github.com/googleapis/python-org-policy/issues/1126)
+
 ## [0.3.0](https://www.github.com/googleapis/python-org-policy/compare/v0.2.0...v0.3.0) (2021-05-16)
 
 
diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
index 180886c..ad25278 100644
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@@ -68,15 +68,12 @@ Using ``nox``
 We use `nox <https://nox.readthedocs.io/en/latest/>`__ to instrument our tests.
 
 - To test your changes, run unit tests with ``nox``::
+    $ nox -s unit
 
-    $ nox -s unit-2.7
-    $ nox -s unit-3.8
-    $ ...
+- To run a single unit test::
 
-- Args to pytest can be passed through the nox command separated by a `--`. For
-  example, to run a single test::
+    $ nox -s unit-3.9 -- -k <name of test>
 
-    $ nox -s unit-3.8 -- -k <name of test>
 
   .. note::
 
@@ -143,8 +140,7 @@ Running System Tests
 - To run system tests, you can execute::
 
    # Run all system tests
-   $ nox -s system-3.8
-   $ nox -s system-2.7
+   $ nox -s system
 
    # Run a single system test
    $ nox -s system-3.8 -- -k <name of test>
@@ -152,9 +148,8 @@ Running System Tests
 
   .. note::
 
-      System tests are only configured to run under Python 2.7 and
-      Python 3.8. For expediency, we do not run them in older versions
-      of Python 3.
+      System tests are only configured to run under Python 3.8.
+      For expediency, we do not run them in older versions of Python 3.
 
   This alone will not run the tests. You'll need to change some local
   auth settings and change some configuration in your project to
@@ -218,8 +213,8 @@ Supported versions can be found in our ``noxfile.py`` `config`_.
 .. _config: https://github.com/googleapis/python-org-policy/blob/master/noxfile.py
 
 
-We also explicitly decided to support Python 3 beginning with version
-3.6. Reasons for this include:
+We also explicitly decided to support Python 3 beginning with version 3.6.
+Reasons for this include:
 
 -  Encouraging use of newest versions of Python 3
 -  Taking the lead of `prominent`_ open-source `projects`_
diff --git a/README.rst b/README.rst
index ce844c9..4572180 100644
--- a/README.rst
+++ b/README.rst
@@ -1,7 +1,7 @@
 Python Client for Organization Policy
 =================================================
 
-|beta| |pypi| |versions|
+|GA| |pypi| |versions|
 
 `Organization Policy`_: The Organization Policy API allows users to configure governance rules on their GCP
 resources across the Cloud Resource Hierarchy.
@@ -9,8 +9,8 @@ resources across the Cloud Resource Hierarchy.
 - `Client Library Documentation`_
 - `Product Documentation`_
 
-.. |beta| image:: https://img.shields.io/badge/support-beta-orange.svg
-   :target: https://github.com/googleapis/google-cloud-python/blob/master/README.rst#beta-support
+.. |GA| image:: https://img.shields.io/badge/support-ga-gold.svg
+   :target: https://github.com/googleapis/google-cloud-python/blob/master/README.rst#general-availability
 .. |pypi| image:: https://img.shields.io/pypi/v/google-cloud-org-policy.svg
    :target: https://pypi.org/project/google-cloud-org-policy/
 .. |versions| image:: https://img.shields.io/pypi/pyversions/google-cloud-org-policy.svg
diff --git a/docs/conf.py b/docs/conf.py
index afae95e..a7296bb 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -80,9 +80,9 @@
 master_doc = "index"
 
 # General information about the project.
-project = u"google-cloud-org-policy"
-copyright = u"2019, Google"
-author = u"Google APIs"
+project = "google-cloud-org-policy"
+copyright = "2019, Google"
+author = "Google APIs"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
@@ -281,7 +281,7 @@
     (
         master_doc,
         "google-cloud-org-policy.tex",
-        u"google-cloud-org-policy Documentation",
+        "google-cloud-org-policy Documentation",
         author,
         "manual",
     )
@@ -316,7 +316,7 @@
     (
         master_doc,
         "google-cloud-org-policy",
-        u"google-cloud-org-policy Documentation",
+        "google-cloud-org-policy Documentation",
         [author],
         1,
     )
@@ -335,7 +335,7 @@
     (
         master_doc,
         "google-cloud-org-policy",
-        u"google-cloud-org-policy Documentation",
+        "google-cloud-org-policy Documentation",
         author,
         "google-cloud-org-policy",
         "google-cloud-org-policy Library",
@@ -363,6 +363,7 @@
     "google.api_core": ("https://googleapis.dev/python/google-api-core/latest/", None,),
     "grpc": ("https://grpc.github.io/grpc/python/", None),
     "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None),
+    "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None),
 }
 
 
diff --git a/docs/multiprocessing.rst b/docs/multiprocessing.rst
index 1cb29d4..536d17b 100644
--- a/docs/multiprocessing.rst
+++ b/docs/multiprocessing.rst
@@ -1,7 +1,7 @@
 .. note::
 
-   Because this client uses :mod:`grpcio` library, it is safe to
+   Because this client uses :mod:`grpc` library, it is safe to
    share instances across threads. In multiprocessing scenarios, the best
    practice is to create client instances *after* the invocation of
-   :func:`os.fork` by :class:`multiprocessing.Pool` or
+   :func:`os.fork` by :class:`multiprocessing.pool.Pool` or
    :class:`multiprocessing.Process`.
diff --git a/google/cloud/orgpolicy_v2/services/org_policy/transports/base.py b/google/cloud/orgpolicy_v2/services/org_policy/transports/base.py
index 8b0c00f..e3dc840 100644
--- a/google/cloud/orgpolicy_v2/services/org_policy/transports/base.py
+++ b/google/cloud/orgpolicy_v2/services/org_policy/transports/base.py
@@ -24,6 +24,7 @@
 from google.api_core import gapic_v1  # type: ignore
 from google.api_core import retry as retries  # type: ignore
 from google.auth import credentials as ga_credentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
 
 from google.cloud.orgpolicy_v2.types import orgpolicy
 from google.protobuf import empty_pb2  # type: ignore
@@ -46,8 +47,6 @@
     except pkg_resources.DistributionNotFound:  # pragma: NO COVER
         _GOOGLE_AUTH_VERSION = None
 
-_API_CORE_VERSION = google.api_core.__version__
-
 
 class OrgPolicyTransport(abc.ABC):
     """Abstract transport class for OrgPolicy."""
@@ -65,6 +64,7 @@ def __init__(
         scopes: Optional[Sequence[str]] = None,
         quota_project_id: Optional[str] = None,
         client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
         **kwargs,
     ) -> None:
         """Instantiate the transport.
@@ -88,6 +88,8 @@ def __init__(
                 API requests. If ``None``, then default info will be used.
                 Generally, you only need to set this if you're developing
                 your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
         """
         # Save the hostname. Default to port 443 (HTTPS) if none is specified.
         if ":" not in host:
@@ -97,7 +99,7 @@ def __init__(
         scopes_kwargs = self._get_scopes_kwargs(self._host, scopes)
 
         # Save the scopes.
-        self._scopes = scopes or self.AUTH_SCOPES
+        self._scopes = scopes
 
         # If no credentials are provided, then determine the appropriate
         # defaults.
@@ -116,13 +118,20 @@ def __init__(
                 **scopes_kwargs, quota_project_id=quota_project_id
             )
 
+        # If the credentials is service account credentials, then always try to use self signed JWT.
+        if (
+            always_use_jwt_access
+            and isinstance(credentials, service_account.Credentials)
+            and hasattr(service_account.Credentials, "with_always_use_jwt_access")
+        ):
+            credentials = credentials.with_always_use_jwt_access(True)
+
         # Save the credentials.
         self._credentials = credentials
 
-    # TODO(busunkim): These two class methods are in the base transport
+    # TODO(busunkim): This method is in the base transport
     # to avoid duplicating code across the transport classes. These functions
-    # should be deleted once the minimum required versions of google-api-core
-    # and google-auth are increased.
+    # should be deleted once the minimum required versions of google-auth is increased.
 
     # TODO: Remove this function once google-auth >= 1.25.0 is required
     @classmethod
@@ -143,27 +152,6 @@ def _get_scopes_kwargs(
 
         return scopes_kwargs
 
-    # TODO: Remove this function once google-api-core >= 1.26.0 is required
-    @classmethod
-    def _get_self_signed_jwt_kwargs(
-        cls, host: str, scopes: Optional[Sequence[str]]
-    ) -> Dict[str, Union[Optional[Sequence[str]], str]]:
-        """Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
-
-        self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
-
-        if _API_CORE_VERSION and (
-            packaging.version.parse(_API_CORE_VERSION)
-            >= packaging.version.parse("1.26.0")
-        ):
-            self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
-            self_signed_jwt_kwargs["scopes"] = scopes
-            self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
-        else:
-            self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
-
-        return self_signed_jwt_kwargs
-
     def _prep_wrapped_messages(self, client_info):
         # Precompute the wrapped methods.
         self._wrapped_methods = {
diff --git a/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py b/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py
index c84a650..aff7f3c 100644
--- a/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py
+++ b/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py
@@ -79,6 +79,7 @@ def __init__(
         client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
         quota_project_id: Optional[str] = None,
         client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
     ) -> None:
         """Instantiate the transport.
 
@@ -119,6 +120,8 @@ def __init__(
                 API requests. If ``None``, then default info will be used.
                 Generally, you only need to set this if you're developing
                 your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
 
         Raises:
           google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
@@ -171,6 +174,7 @@ def __init__(
             scopes=scopes,
             quota_project_id=quota_project_id,
             client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
         )
 
         if not self._grpc_channel:
@@ -226,14 +230,14 @@ def create_channel(
               and ``credentials_file`` are passed.
         """
 
-        self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
-
         return grpc_helpers.create_channel(
             host,
             credentials=credentials,
             credentials_file=credentials_file,
             quota_project_id=quota_project_id,
-            **self_signed_jwt_kwargs,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
             **kwargs,
         )
 
diff --git a/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py b/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py
index c868a74..4aa679e 100644
--- a/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py
+++ b/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py
@@ -100,14 +100,14 @@ def create_channel(
             aio.Channel: A gRPC AsyncIO channel object.
         """
 
-        self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
-
         return grpc_helpers_async.create_channel(
             host,
             credentials=credentials,
             credentials_file=credentials_file,
             quota_project_id=quota_project_id,
-            **self_signed_jwt_kwargs,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
             **kwargs,
         )
 
@@ -125,6 +125,7 @@ def __init__(
         client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
         quota_project_id=None,
         client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
     ) -> None:
         """Instantiate the transport.
 
@@ -166,6 +167,8 @@ def __init__(
                 API requests. If ``None``, then default info will be used.
                 Generally, you only need to set this if you're developing
                 your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
 
         Raises:
             google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
@@ -217,6 +220,7 @@ def __init__(
             scopes=scopes,
             quota_project_id=quota_project_id,
             client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
         )
 
         if not self._grpc_channel:
diff --git a/noxfile.py b/noxfile.py
index 3010fda..ffc58c9 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -209,7 +209,7 @@ def docs(session):
     """Build the docs for this library."""
 
     session.install("-e", ".")
-    session.install("sphinx", "alabaster", "recommonmark")
+    session.install("sphinx==4.0.1", "alabaster", "recommonmark")
 
     shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True)
     session.run(
@@ -231,7 +231,9 @@ def docfx(session):
     """Build the docfx yaml files for this library."""
 
     session.install("-e", ".")
-    session.install("sphinx", "alabaster", "recommonmark", "gcp-sphinx-docfx-yaml")
+    session.install(
+        "sphinx==4.0.1", "alabaster", "recommonmark", "gcp-sphinx-docfx-yaml"
+    )
 
     shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True)
     session.run(
diff --git a/setup.py b/setup.py
index 0871385..47d3c46 100644
--- a/setup.py
+++ b/setup.py
@@ -19,7 +19,7 @@
 import os
 import setuptools  # type: ignore
 
-version = "0.3.0"
+version = "1.0.0"
 
 package_root = os.path.abspath(os.path.dirname(__file__))
 
@@ -41,13 +41,13 @@
     platforms="Posix; MacOS X; Windows",
     include_package_data=True,
     install_requires=(
-        "google-api-core[grpc] >= 1.22.2, < 2.0.0dev",
+        "google-api-core[grpc] >= 1.26.0, <2.0.0dev",
         "proto-plus >= 1.10.0",
         "packaging >= 14.3",
     ),
     python_requires=">=3.6",
     classifiers=[
-        "Development Status :: 4 - Beta",
+        "Development Status :: 5 - Production/Stable",
         "Intended Audience :: Developers",
         "Operating System :: OS Independent",
         "Programming Language :: Python :: 3.6",
diff --git a/testing/constraints-3.6.txt b/testing/constraints-3.6.txt
index 30d4943..9c94995 100644
--- a/testing/constraints-3.6.txt
+++ b/testing/constraints-3.6.txt
@@ -19,6 +19,6 @@
 #
 # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
 # Then this file should have foo==1.14.0
-google-api-core==1.22.2
+google-api-core==1.26.0
 proto-plus==1.10.0
 packaging==14.3
diff --git a/tests/unit/gapic/orgpolicy_v2/test_org_policy.py b/tests/unit/gapic/orgpolicy_v2/test_org_policy.py
index 4465ebd..65446e4 100644
--- a/tests/unit/gapic/orgpolicy_v2/test_org_policy.py
+++ b/tests/unit/gapic/orgpolicy_v2/test_org_policy.py
@@ -35,9 +35,6 @@
 from google.cloud.orgpolicy_v2.services.org_policy import OrgPolicyClient
 from google.cloud.orgpolicy_v2.services.org_policy import pagers
 from google.cloud.orgpolicy_v2.services.org_policy import transports
-from google.cloud.orgpolicy_v2.services.org_policy.transports.base import (
-    _API_CORE_VERSION,
-)
 from google.cloud.orgpolicy_v2.services.org_policy.transports.base import (
     _GOOGLE_AUTH_VERSION,
 )
@@ -49,8 +46,9 @@
 import google.auth
 
 
-# TODO(busunkim): Once google-api-core >= 1.26.0 is required:
-# - Delete all the api-core and auth "less than" test cases
+# TODO(busunkim): Once google-auth >= 1.25.0 is required transitively
+# through google-api-core:
+# - Delete the auth "less than" test cases
 # - Delete these pytest markers (Make the "greater than or equal to" tests the default).
 requires_google_auth_lt_1_25_0 = pytest.mark.skipif(
     packaging.version.parse(_GOOGLE_AUTH_VERSION) >= packaging.version.parse("1.25.0"),
@@ -61,16 +59,6 @@
     reason="This test requires google-auth >= 1.25.0",
 )
 
-requires_api_core_lt_1_26_0 = pytest.mark.skipif(
-    packaging.version.parse(_API_CORE_VERSION) >= packaging.version.parse("1.26.0"),
-    reason="This test requires google-api-core < 1.26.0",
-)
-
-requires_api_core_gte_1_26_0 = pytest.mark.skipif(
-    packaging.version.parse(_API_CORE_VERSION) < packaging.version.parse("1.26.0"),
-    reason="This test requires google-api-core >= 1.26.0",
-)
-
 
 def client_cert_source_callback():
     return b"cert bytes", b"key bytes"
@@ -126,6 +114,34 @@ def test_org_policy_client_from_service_account_info(client_class):
         assert client.transport._host == "orgpolicy.googleapis.com:443"
 
 
+@pytest.mark.parametrize("client_class", [OrgPolicyClient, OrgPolicyAsyncClient,])
+def test_org_policy_client_service_account_always_use_jwt(client_class):
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        client = client_class(credentials=creds)
+        use_jwt.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "transport_class,transport_name",
+    [
+        (transports.OrgPolicyGrpcTransport, "grpc"),
+        (transports.OrgPolicyGrpcAsyncIOTransport, "grpc_asyncio"),
+    ],
+)
+def test_org_policy_client_service_account_always_use_jwt_true(
+    transport_class, transport_name
+):
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        transport = transport_class(credentials=creds, always_use_jwt_access=True)
+        use_jwt.assert_called_once_with(True)
+
+
 @pytest.mark.parametrize("client_class", [OrgPolicyClient, OrgPolicyAsyncClient,])
 def test_org_policy_client_from_service_account_file(client_class):
     creds = ga_credentials.AnonymousCredentials()
@@ -2321,7 +2337,6 @@ def test_org_policy_transport_auth_adc_old_google_auth(transport_class):
         (transports.OrgPolicyGrpcAsyncIOTransport, grpc_helpers_async),
     ],
 )
-@requires_api_core_gte_1_26_0
 def test_org_policy_transport_create_channel(transport_class, grpc_helpers):
     # If credentials and host are not provided, the transport class should use
     # ADC credentials.
@@ -2350,77 +2365,6 @@ def test_org_policy_transport_create_channel(transport_class, grpc_helpers):
         )
 
 
-@pytest.mark.parametrize(
-    "transport_class,grpc_helpers",
-    [
-        (transports.OrgPolicyGrpcTransport, grpc_helpers),
-        (transports.OrgPolicyGrpcAsyncIOTransport, grpc_helpers_async),
-    ],
-)
-@requires_api_core_lt_1_26_0
-def test_org_policy_transport_create_channel_old_api_core(
-    transport_class, grpc_helpers
-):
-    # If credentials and host are not provided, the transport class should use
-    # ADC credentials.
-    with mock.patch.object(
-        google.auth, "default", autospec=True
-    ) as adc, mock.patch.object(
-        grpc_helpers, "create_channel", autospec=True
-    ) as create_channel:
-        creds = ga_credentials.AnonymousCredentials()
-        adc.return_value = (creds, None)
-        transport_class(quota_project_id="octopus")
-
-        create_channel.assert_called_with(
-            "orgpolicy.googleapis.com:443",
-            credentials=creds,
-            credentials_file=None,
-            quota_project_id="octopus",
-            scopes=("https://www.googleapis.com/auth/cloud-platform",),
-            ssl_credentials=None,
-            options=[
-                ("grpc.max_send_message_length", -1),
-                ("grpc.max_receive_message_length", -1),
-            ],
-        )
-
-
-@pytest.mark.parametrize(
-    "transport_class,grpc_helpers",
-    [
-        (transports.OrgPolicyGrpcTransport, grpc_helpers),
-        (transports.OrgPolicyGrpcAsyncIOTransport, grpc_helpers_async),
-    ],
-)
-@requires_api_core_lt_1_26_0
-def test_org_policy_transport_create_channel_user_scopes(transport_class, grpc_helpers):
-    # If credentials and host are not provided, the transport class should use
-    # ADC credentials.
-    with mock.patch.object(
-        google.auth, "default", autospec=True
-    ) as adc, mock.patch.object(
-        grpc_helpers, "create_channel", autospec=True
-    ) as create_channel:
-        creds = ga_credentials.AnonymousCredentials()
-        adc.return_value = (creds, None)
-
-        transport_class(quota_project_id="octopus", scopes=["1", "2"])
-
-        create_channel.assert_called_with(
-            "orgpolicy.googleapis.com:443",
-            credentials=creds,
-            credentials_file=None,
-            quota_project_id="octopus",
-            scopes=["1", "2"],
-            ssl_credentials=None,
-            options=[
-                ("grpc.max_send_message_length", -1),
-                ("grpc.max_receive_message_length", -1),
-            ],
-        )
-
-
 @pytest.mark.parametrize(
     "transport_class",
     [transports.OrgPolicyGrpcTransport, transports.OrgPolicyGrpcAsyncIOTransport],
@@ -2440,7 +2384,7 @@ def test_org_policy_grpc_transport_client_cert_source_for_mtls(transport_class):
             "squid.clam.whelk:443",
             credentials=cred,
             credentials_file=None,
-            scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            scopes=None,
             ssl_credentials=mock_ssl_channel_creds,
             quota_project_id=None,
             options=[
@@ -2544,7 +2488,7 @@ def test_org_policy_transport_channel_mtls_with_client_cert_source(transport_cla
                 "mtls.squid.clam.whelk:443",
                 credentials=cred,
                 credentials_file=None,
-                scopes=("https://www.googleapis.com/auth/cloud-platform",),
+                scopes=None,
                 ssl_credentials=mock_ssl_cred,
                 quota_project_id=None,
                 options=[
@@ -2588,7 +2532,7 @@ def test_org_policy_transport_channel_mtls_with_adc(transport_class):
                 "mtls.squid.clam.whelk:443",
                 credentials=mock_cred,
                 credentials_file=None,
-                scopes=("https://www.googleapis.com/auth/cloud-platform",),
+                scopes=None,
                 ssl_credentials=mock_ssl_cred,
                 quota_project_id=None,
                 options=[