How to create an attestation policy to attest whether the user belongs to that role?

I would like to certify that users obtain a role, and thus send managers an email confirming that the user actually has that role.