diff --git a/docs/admin/keys-and-permissions.mdx b/docs/admin/keys-and-permissions.mdx
index df4475245..ec233d87f 100644
--- a/docs/admin/keys-and-permissions.mdx
+++ b/docs/admin/keys-and-permissions.mdx
@@ -65,6 +65,7 @@ Key secrets are shown when created or regenerated. Store them in a secret manage
 | Issues | `issues:read`, `issues:create`, `issues:close` |
 | Audits | `audits:read`, `audits:write` |
 | Policies | `policies:read`, `policies:write`, `policies:pull` |
+| Code fixes | `code_fixes:read`, `code_fixes:write` |
 | Usage | `usage:read` |
 | Jev | `jev:evaluate` (requires `events:add` and `policies:pull`) |
 
diff --git a/docs/audits/code-fixes.mdx b/docs/audits/code-fixes.mdx
new file mode 100644
index 000000000..0a9c7fca6
--- /dev/null
+++ b/docs/audits/code-fixes.mdx
@@ -0,0 +1,32 @@
+---
+title: "Code fixes"
+description: "Turn an insight into a GitHub issue or a pull request, from the insight itself."
+icon: "git-pull-request"
+---
+
+A policy stops an agent doing the wrong thing. Sometimes the problem is how the agent is built, and the fix belongs in its code. Code fixes finish that loop from the same place you found the problem.
+
+## From insight to pull request
+
+Policies come first. When a policy can't stop the problem and the agent's code can, the insight offers two things, and one click does either:
+
+- **Create a pull request.** Codex works on a copy of your repository, makes the change and runs what tests it can, then opens a draft pull request for your team to review. You get an email when it opens.
+- **Raise a GitHub issue.** The insight's findings go to your repository's issues, for someone on your team to pick up.
+
+The click is the go-ahead, recorded against the person who made it. The insight says who asked, links to the result, and says when the pull request is merged or closed.
+
+A pull request is always yours to review, and nothing merges by itself.
+
+## From Slack and your AI tools
+
+You don't have to open the dashboard. Ask in Slack, or through FailproofAI's MCP server in an AI tool like Claude or Cursor, and the assistant tells you what can fix an issue.
+
+- **In Slack:** the assistant suggests what fits, policies first. Pick one and answer yes. Codex runs in FailproofAI Cloud, and the thread hears when the pull request opens.
+- **In your AI tool:** you have two choices. Submit the job to run in FailproofAI Cloud, the same as from Slack. Or get the full context of the issue, including the rules the agent must keep, and have your own agent make the change and raise the pull request itself.
+
+## What it needs
+
+- GitHub connected, with the agent linked to the folder that runs it.
+- The `code_fixes:write` permission to raise a fix or stop one, and `code_fixes:read` to see them. These are separate from `policies:read` and `policies:write`.
+
+GitHub connects the same way everywhere, with no app to create and no key to set. Your code goes between GitHub and your deployment directly.
diff --git a/docs/docs.json b/docs/docs.json
index 50ddf63e7..c9c7f81be 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -160,7 +160,8 @@
                   "audits/cadence",
                   "audits/findings-and-issues",
                   "audits/alerts",
-                  "audits/recipes"
+                  "audits/recipes",
+                  "audits/code-fixes"
                 ]
               }
             ]
diff --git a/fp-cloud-cli/fp_cli/permissions.py b/fp-cloud-cli/fp_cli/permissions.py
index 27a5a25e2..445e6920e 100644
--- a/fp-cloud-cli/fp_cli/permissions.py
+++ b/fp-cloud-cli/fp_cli/permissions.py
@@ -47,6 +47,8 @@
     "policies:read",
     "policies:write",
     "policies:pull",
+    "code_fixes:read",
+    "code_fixes:write",
     "usage:read",
     # Jev through FailproofAI Cloud, charged to the org's plan. The built-in
     # admin set carries it, so PRESETS["admin"] below does too. The server