diff --git a/scripts/mutation-gate.mjs b/scripts/mutation-gate.mjs
index fddc9860..ca1e490f 100644
--- a/scripts/mutation-gate.mjs
+++ b/scripts/mutation-gate.mjs
@@ -8046,6 +8046,17 @@ const MUTANT_DEFINITIONS = [
       replace: "export const isPinned = (spec) => /^[\\w.-]+\\/[\\w./-]+@\\S+$/.test(spec);",
     }],
   },
+  {
+    id: 'review-model-gets-repository-write',
+    guard: 'node --test --test-name-pattern="по job" test/review-doc-guard.test.mjs',
+    because: '#556: недоверенная стадия с правом записи в репозиторий может положить коммит в '
+      + 'ветку задачи в обход ревью и слияния — потолок прав этой job проверяется дословно',
+    patches: [{
+      file: '.github/workflows/process.yml',
+      find: '    permissions:\n      contents: read\n      issues: write\n    needs: [guard, prepare]\n',
+      replace: '    permissions:\n      contents: write\n      issues: write\n    needs: [guard, prepare]\n',
+    }],
+  },
   {
     id: 'review-job-trusts-the-app-token',
     guard: 'node --test --test-name-pattern="job-scoped" test/review-doc-guard.test.mjs',