T3 Code explained: the client controls work on another machine
T3 Code security: pairing, scoped RPC and permission defaults
Treat a remote control link as authority over the environment, not as a harmless URL
What you will learn
- Protect pairing and sessions
- Check authorization after transport
- Narrow agent actions
Before you start
- A disposable project on an environment host
- One authenticated supported provider
Turn a disposable trial into evidence before connecting important repositories
Key takeaways
- A relay credential is not a server login.
- Authenticated socket and authorized RPC are separate.
- Projects are not filesystem sandboxes.
Protect pairing and sessions
Pairing authorizes a device for future access. The remote guide says to use a fresh one-time link per device and treat links and authorization codes as passwords. The environment issues its own scoped sessions; a relay token is not an environment login.
The hosted pairing secret belongs in the URL fragment, not a query parameter sent to the hosted origin. Avoid pasting pairing links into issue trackers or logs, and revoke a test device after setup.
Check authorization after transport
An authenticated socket is not permission for every method. RPCs declare required scopes and server middleware enforces them. DPoP proof failure must not silently fall back to bearer authentication.
Project labels are organizational, not filesystem sandboxes. The auth document says `orchestration:read` can read any file readable by the server account, including absolute paths outside the selected project. Plan host-user isolation accordingly.
Narrow agent actions
The pinned permission guide says Full access is the initial default for new threads, while Supervised requests approvals for commands and file changes. Provider implementations differ, including fallback behavior for Auto mode.
Before remote use, set an appropriate default and project override, confirm the current thread mode, and review the provider’s own permission behavior. This source review did not penetrate-test pairing or sandbox the server.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Create one-time pairing links and revoke a test device.
- 2
Review RPC scope and host filesystem exposure.
- 3
Set permission mode before the first remote task.
Copy-ready example
pairing link -> scoped environment session -> RPC scope gate
server account -> provider + files
thread permission -> agent action reviewFrequently asked questions
Can a paired client read only files inside the selected project?
Not necessarily. The auth document says a suitable read scope can reach files accessible to the server account.
Is Full access the safest first-run mode?
No. It is the pinned default for new threads, but Supervised requests more approval.
Sources
- T3 Code / docs/user/remote-access.mdSource checked 2026-10-04
- T3 Code / docs/internals/environment-auth.mdSource checked 2026-10-04
- T3 Code / docs/user/permission-modes.mdSource checked 2026-10-04
- T3 Code / docs/internals/remote.mdSource checked 2026-10-04