diff --git a/tests/e2e/sample-attester/04-resource-policy.yaml b/tests/e2e/sample-attester/04-resource-policy.yaml
index b6267d1..a43a95e 100644
--- a/tests/e2e/sample-attester/04-resource-policy.yaml
+++ b/tests/e2e/sample-attester/04-resource-policy.yaml
@@ -7,7 +7,4 @@ data:
   policy.rego: |
     package policy
 
-    default allow = false
-    allow {
-            input["tcb-status"]["sample.svn"] == "1"
-    }
+    default allow = true
diff --git a/tests/e2e/sample-attester/06-assert.yaml b/tests/e2e/sample-attester/06-assert.yaml
deleted file mode 100644
index 0513c8a..0000000
--- a/tests/e2e/sample-attester/06-assert.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: trustee-deployment
-  namespace: trustee-operator-system
-status:
-  readyReplicas: 1
\ No newline at end of file
diff --git a/tests/e2e/sample-attester/06-attestation-policy.yaml b/tests/e2e/sample-attester/06-attestation-policy.yaml
new file mode 100644
index 0000000..970f533
--- /dev/null
+++ b/tests/e2e/sample-attester/06-attestation-policy.yaml
@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: attestation-policy
+  namespace: trustee-operator-system
+data:
+  default.rego: |
+    package policy
+
+    import future.keywords.every
+
+    default allow = false
+
+    allow {
+      every k, v in input {
+        # `judge_field`: Traverse each key value pair in the input and make policy judgments on it.
+        #
+        # For each key value pair:
+        #	* If there isn't a corresponding key in the reference:
+        #		It is considered that the current key value pair has passed the verification.
+        #	* If there is a corresponding key in the reference:
+        #		Call `match_value` to further judge the value in input with the value in reference.
+        judge_field(k, v)
+      }
+    }
+
+    judge_field(input_key, input_value) {
+      has_key(data.reference, input_key)
+      reference_value := data.reference[input_key]
+
+      # `match_value`: judge the value in input with the value in reference.
+      #
+      # * If the type of reference value is not array:
+      #		Judge whether input value and reference value are equal。
+      # * If the type of reference value is array:
+      #		Call `array_include` to further judge the input value with the values in the array.
+      match_value(reference_value, input_value)
+    }
+
+    judge_field(input_key, input_value) {
+      not has_key(data.reference, input_key)
+    }
+
+    match_value(reference_value, input_value) {
+      not is_array(reference_value)
+      input_value == reference_value
+    }
+
+    match_value(reference_value, input_value) {
+      is_array(reference_value)
+
+      # `array_include`: judge the input value with the values in the array.
+      #
+      # * If the reference value array is empty:
+      #		It is considered that the current input value has passed the verification.
+      # * If the reference value array is not empty:
+      #		Judge whether there is a value equal to input value in the reference value array.
+      array_include(reference_value, input_value)
+    }
+
+    array_include(reference_value_array, input_value) {
+      reference_value_array == []
+    }
+
+    array_include(reference_value_array, input_value) {
+      reference_value_array != []
+      some i
+      reference_value_array[i] == input_value
+    }
+
+    has_key(m, k) {
+      _ = m[k]
+    }
diff --git a/tests/e2e/sample-attester/07-assert.yaml b/tests/e2e/sample-attester/07-assert.yaml
index 6ae73a3..0513c8a 100644
--- a/tests/e2e/sample-attester/07-assert.yaml
+++ b/tests/e2e/sample-attester/07-assert.yaml
@@ -1,8 +1,7 @@
-apiVersion: v1
-kind: Pod
+apiVersion: apps/v1
+kind: Deployment
 metadata:
-  name: kbs-client
+  name: trustee-deployment
   namespace: trustee-operator-system
 status:
-  containerStatuses:
-  - ready: true
\ No newline at end of file
+  readyReplicas: 1
\ No newline at end of file
diff --git a/tests/e2e/sample-attester/06-kbsconfig_sample.yaml b/tests/e2e/sample-attester/07-kbsconfig_sample.yaml
similarity index 92%
rename from tests/e2e/sample-attester/06-kbsconfig_sample.yaml
rename to tests/e2e/sample-attester/07-kbsconfig_sample.yaml
index 5a812a4..52d6267 100644
--- a/tests/e2e/sample-attester/06-kbsconfig_sample.yaml
+++ b/tests/e2e/sample-attester/07-kbsconfig_sample.yaml
@@ -15,6 +15,7 @@ spec:
   kbsDeploymentType: AllInOneDeployment
   kbsRvpsRefValuesConfigMapName: rvps-reference-values
   kbsResourcePolicyConfigMapName: resource-policy
+  kbsAttestationPolicyConfigMapName: attestation-policy
   kbsSecretResources:
     - "kbsres1"
   KbsEnvVars: 
diff --git a/tests/e2e/sample-attester/08-assert.yaml b/tests/e2e/sample-attester/08-assert.yaml
index 40cc627..6ae73a3 100644
--- a/tests/e2e/sample-attester/08-assert.yaml
+++ b/tests/e2e/sample-attester/08-assert.yaml
@@ -1,5 +1,8 @@
 apiVersion: v1
-kind: Secret
+kind: Pod
 metadata:
-  name: trustee-secret
+  name: kbs-client
   namespace: trustee-operator-system
+status:
+  containerStatuses:
+  - ready: true
\ No newline at end of file
diff --git a/tests/e2e/sample-attester/07-client.yaml b/tests/e2e/sample-attester/08-client.yaml
similarity index 100%
rename from tests/e2e/sample-attester/07-client.yaml
rename to tests/e2e/sample-attester/08-client.yaml
diff --git a/tests/e2e/sample-attester/09-assert.yaml b/tests/e2e/sample-attester/09-assert.yaml
new file mode 100644
index 0000000..40cc627
--- /dev/null
+++ b/tests/e2e/sample-attester/09-assert.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trustee-secret
+  namespace: trustee-operator-system
diff --git a/tests/e2e/sample-attester/08-get-secret.yaml b/tests/e2e/sample-attester/09-get-secret.yaml
similarity index 100%
rename from tests/e2e/sample-attester/08-get-secret.yaml
rename to tests/e2e/sample-attester/09-get-secret.yaml
diff --git a/tests/e2e/sample-attester/create-other-secret.sh b/tests/e2e/sample-attester/create-other-secret.sh
index 9fdb980..b775c53 100755
--- a/tests/e2e/sample-attester/create-other-secret.sh
+++ b/tests/e2e/sample-attester/create-other-secret.sh
@@ -1,3 +1,4 @@
 #!/bin/bash
 
-kubectl create secret generic kbsres1 --from-literal key1=res1val1 --from-literal key2=res1val2 -n trustee-operator-system
\ No newline at end of file
+kubectl create secret generic kbsres1 --from-literal key1=res1val1 --from-literal key2=res1val2 -n trustee-operator-system
+
diff --git a/tests/e2e/sample-attester/install-operator.sh b/tests/e2e/sample-attester/install-operator.sh
index f0985ba..22eb1fb 100755
--- a/tests/e2e/sample-attester/install-operator.sh
+++ b/tests/e2e/sample-attester/install-operator.sh
@@ -21,5 +21,5 @@ make build-installer
 kubectl apply -f dist/install.yaml
 
 pushd tests/e2e/sample-attester
-kustomize edit set image $CLIENT_IMAGE_NAME
+kustomize edit set image quay.io/confidential-containers/kbs-client=$CLIENT_IMAGE_NAME
 popd
\ No newline at end of file