diff --git a/groups b/groups
index ba03083..0c1a483 100644
--- a/groups
+++ b/groups
@@ -1,11 +1,12 @@
-# UUID                  	Group Name
+# UUID                                  	Group Name
 #
-global:Anonymous-Users  	Anonymous Users
-global:Project-Owners   	Project Owners
-global:Registered-Users 	Registered Users
-ldap:rch                	ldap/rch
-mdb:copybara-git-readers	mdb/copybara-git-readers
-mdb:copybara-git-writers	mdb/copybara-git-writers
-mdb:quiche-dev          	mdb/quiche-dev
-mdb:quiche-dev-git-admin	mdb/quiche-dev-git-admin
-mdb:quiche-roll-branches	mdb/quiche-roll-branches
+74a4e7cc6afdd426825c80f5bafa4ab56ee19b10	SLSA Policy Verification Service Accounts
+global:Anonymous-Users                  	Anonymous Users
+global:Project-Owners                   	Project Owners
+global:Registered-Users                 	Registered Users
+ldap:rch                                	ldap/rch
+mdb:copybara-git-readers                	mdb/copybara-git-readers
+mdb:copybara-git-writers                	mdb/copybara-git-writers
+mdb:quiche-dev                          	mdb/quiche-dev
+mdb:quiche-dev-git-admin                	mdb/quiche-dev-git-admin
+mdb:quiche-roll-branches                	mdb/quiche-roll-branches
diff --git a/project.config b/project.config
index 2cad5cb..e5a996f 100644
--- a/project.config
+++ b/project.config
@@ -39,6 +39,8 @@
 	submit = group mdb/quiche-dev
 	submit = group mdb/quiche-dev-git-admin
 	addPatchSet = group mdb/quiche-dev-git-admin
+	label-SLSA-Policy-Verified = -1..+1 group SLSA Policy Verification Service Accounts
+	Read = group SLSA Policy Verification Service Accounts
 [access "refs/meta/config"]
 	exclusiveGroupPermissions = read
 	create = group Project Owners
@@ -84,20 +86,4 @@
 [capability]
 	administrateServer = group mdb/quiche-dev-git-admin
 	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	gerrit-google-manageUsersGet = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
-	viewAllAccounts = group mdb/copybara-git-readers
 	viewAllAccounts = group mdb/copybara-git-readers