A statement predicate is the part of an attestation that carries the actual claim about a build, test, scan, or release step. It sits inside the overall statement format and is where the meaningful evidence, results, or metadata are expressed for verification.
Statement Predicate in an Attestation
The statement predicate is the part of an attestation that carries the claim being made about a build, test, scan, or release step. It is the payload that verification tools and policy engines examine to decide whether the attestation is meaningful and trustworthy.
What the Statement Predicate Contains
In practice, the predicate usually holds the evidence-bearing details that make an attestation useful, such as step outcomes, measured results, metadata about the build or pipeline, or references to the materials that were produced. The surrounding statement format gives the attestation structure, but the predicate is where the substantive content lives.
Because the predicate is the claim-bearing portion, its schema and fields matter. If the predicate is too sparse, inconsistently shaped, or loosely defined, downstream consumers may not be able to compare attestations, automate checks, or rely on them as durable proof of what happened in the software supply chain.
Why the Predicate Matters for Verification
Verification depends on being able to inspect the predicate and interpret it consistently. A signed attestation can still be weak if the predicate does not express the right claim, omits important context, or uses fields that different tools understand differently. The integrity of the statement format is only part of the story; the predicate determines what is actually being asserted.
That is why predicate design is closely tied to provenance, policy enforcement, and release trust. A verifier may accept the signature and still reject the attestation if the predicate does not match the required build conditions, expected workflow, or control criteria. For a broader control perspective, organisations often align these checks with supply-chain governance in SLSA and with evidence handling patterns described in NIST SP 800-53 Rev 5 Security and Privacy Controls.
How the Predicate Fits into Supply-Chain Trust
The predicate is most valuable when it preserves a clear chain from activity to evidence. In software delivery, that means the claim should be specific enough to support release decisions, audit trails, and post-incident review. A vague predicate may still be syntactically valid, but it is operationally poor because it cannot reliably answer what was built, tested, scanned, or deployed.
Good predicate design also supports interoperability. When teams standardise the meaning of the predicate across tools and pipelines, they reduce the chance that a verifier misreads the evidence or that one system emits claims another system cannot interpret. In that sense, the predicate is both a technical schema element and a governance boundary for trustworthy automation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply-chain Levels for Software Artifacts | Statement predicates carry the evidence claims SLSA-style provenance checks evaluate. |
| Recommendation — Define attestation predicates so provenance verifiers can assess build integrity and release trust. | ||
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Predicate claims support integrity verification of build and release evidence. |
| AU-10 — Non-repudiation | Signed attestations with meaningful predicates support accountability for asserted build evidence. | |
| Recommendation — Bind attestation predicates to integrity checks that validate the software artifact supply chain. Preserve predicate content and signatures so attestation claims remain attributable and verifiable. | ||