---
component: provenance-governor
version: "1.7"
slug: provenance-governor/policy-type-attestations-exist
canonical_url: "https://docs.gradle.com/develocity/provenance-governor/1.7/policy-type-attestations-exist/"
title: "AttestationsExist Policy"
description: "Reference for the AttestationsExist policy type."
keywords:
  - "attestation"
  - "supply chain"
  - "configuration"
status: current
---

<!-- llms-index: https://docs.gradle.com/develocity/llms.txt -->

# AttestationsExist Policy

<a id="preamble"></a>

The `AttestationsExist` policy requires that specific attestations are present for an artifact. Unlike other policy types, this policy does not evaluate attestation content — it only checks that attestations with the specified predicate types exist.

<a id="spec-fields"></a>

## Spec Fields

**expectedPredicates** — A list of predicate type URIs that must be present. Supported predicate types:

*   `[https://gradle.com/attestation/build-tool/v1](https://gradle.com/attestation/build-tool/v1)` — see [Build Tool Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-build-tool/)
    
*   `[https://gradle.com/attestation/java-toolchains/v1](https://gradle.com/attestation/java-toolchains/v1)` — see [Java Toolchains Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-java-toolchains/)
    
*   `[https://gradle.com/attestation/resolved-dependencies-repositories/v1](https://gradle.com/attestation/resolved-dependencies-repositories/v1)` — see [Resolved Dependencies Repositories Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-resolved-dependencies-repositories/)
    
*   `[https://gradle.com/attestation/resolved-dependencies/v1](https://gradle.com/attestation/resolved-dependencies/v1)` — see [Resolved Dependencies Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-resolved-dependencies/)
    
*   `[https://gradle.com/attestation/publish-repositories/v1](https://gradle.com/attestation/publish-repositories/v1)` — see [Publish Repositories Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-publish-repositories/)
    
*   `[https://slsa.dev/verification_summary/v1](https://slsa.dev/verification_summary/v1)` — see [Verification Summary Predicate](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-verification-summary/)

<a id="examples"></a>

## Examples

<a id="require-build-tool-attestation"></a>

### Require Build Tool Attestation

```yaml
apiVersion: policy.gradle.com/v1
kind: AttestationsExist
metadata:
  name: require-build-tool-attestation
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Require Build Tool attestation to be present
  remediation: Ensure build publishes a Build Tool attestation
  expectedPredicates:
    - https://gradle.com/attestation/build-tool/v1
```

<a id="require-verification-summary-attestation-vsa"></a>

### Require Verification Summary Attestation (VSA)

```yaml
apiVersion: policy.gradle.com/v1
kind: AttestationsExist
metadata:
  name: require-verification-summary-attestation
  labels:
    policy.my-corp.com/gate: production
spec:
  resultsLabels:
    policy.my-corp.com/gate: production
  description: Require Verification Summary attestation (VSA) to be present
  remediation: Ensure package has passed policy scan which generates a VSA
  expectedPredicates:
    - https://slsa.dev/verification_summary/v1
```

> [!NOTE]
> Verification Summary Attestations (VSAs) are generated automatically when Policy Scan™ evaluations execute. Requiring a VSA ensures that packages have been evaluated against policies before deployment.