diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index 2d22ed453..231fd13d8 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -381,8 +381,15 @@ These EC2 and EFS `Describe*` actions do not support resource-level scoping, so
 | Action                                           | CLI Commands                              | Purpose                                       |
 | ------------------------------------------------ | ----------------------------------------- | --------------------------------------------- |
 | `bedrock-agentcore:Evaluate`                     | `run evals`                               | Run on-demand evaluation against agent traces |
+| `lambda:InvokeFunction`                          | `run evals`                               | Invoke code-based evaluator Lambda functions  |
 | `bedrock-agentcore:UpdateOnlineEvaluationConfig` | `pause online-eval`, `resume online-eval` | Pause or resume online evaluation             |
 
+`bedrock-agentcore:Evaluate` invokes a code-based evaluator's Lambda function using the **caller's** identity, so
+`lambda:InvokeFunction` is required on the caller when running `run eval` against a `code-based` evaluator (including
+DeepEval and Autoevals third-party evaluators). Evaluator functions are named `<AgentName>-eval-<evaluatorName>`, so the
+permission can be scoped to `arn:*:lambda:*:*:function:*-eval-*`. Builtin and `llm-as-a-judge` evaluators do not need
+this permission.
+
 ### Batch evaluation and recommendations
 
 | Action                                    | CLI Commands           | Purpose                        |
diff --git a/docs/policies/iam-policy-user.json b/docs/policies/iam-policy-user.json
index f3378bb83..b9100d39e 100644
--- a/docs/policies/iam-policy-user.json
+++ b/docs/policies/iam-policy-user.json
@@ -56,6 +56,12 @@
       ],
       "Resource": "*"
     },
+    {
+      "Sid": "CodeBasedEvaluatorInvocation",
+      "Effect": "Allow",
+      "Action": "lambda:InvokeFunction",
+      "Resource": "arn:*:lambda:*:*:function:*-eval-*"
+    },
     {
       "Sid": "AgentCoreResourceStatus",
       "Effect": "Allow",