Runtime modes: Full Access vs Supervised
What Full Access and Supervised actually change in T3 Code, the risk each one carries, and a practical rule for deciding which repositories deserve which mode.
T3 Code asks you to pick a runtime mode on first launch. It is the only genuinely consequential setting in the product, and the default is the permissive one.
The two modes#
| Full Access | Supervised | |
|---|---|---|
| Shell commands | Run immediately | Require approval |
| File writes | Applied immediately | Require approval |
| Speed | Uninterrupted | Stops at every action |
| Unattended runs | Possible | Not really |
| Default | Yes | No |
Full Access is the default: the agent runs commands and modifies files without asking. This is what makes long autonomous runs work — an agent that has to stop for permission fifty times isn't autonomous.
Supervised puts a confirmation in front of each command and each file modification. You see the exact command before it executes.
What the boundary actually is#
Worth being blunt: the runtime mode governs approval prompts, not sandboxing. In Full Access mode the agent runs with your user's privileges. It can read any file you can read, run any command you can run, and reach any network your machine can reach. Supervised mode doesn't reduce those capabilities — it just gives you a chance to say no first.
That distinction matters in two situations:
- Untrusted repository content. A repo you just cloned can contain instructions in a README, issue template or source comment aimed at the agent rather than at you. In Full Access, the consequences land before you see them.
- Credentials on the box. Your
~/.aws,~/.ssh,.envfiles and cloud CLI sessions are all within reach. The agent isn't malicious, but a confused agent debugging a deploy script can do real damage with real credentials.
If a repository is worth being careful about, the stronger control is running it on a machine or container that doesn't hold anything valuable — not Supervised mode.
A practical rule#
| Situation | Mode |
|---|---|
| Your own project, familiar code, on a branch | Full Access |
| Work in an isolated worktree | Full Access |
| Repository you just cloned and haven't read | Supervised |
| Anything touching infrastructure, deploys or migrations | Supervised |
| Your first week with T3 Code | Supervised |
| Remote server holding production credentials | Supervised, and reconsider the setup |
Why Supervised is worth a week anyway#
Even if you end up on Full Access permanently, run Supervised for your first several sessions. You learn what the agent actually does between messages — how many times it greps, how it explores before editing, where it guesses. That intuition is what makes you good at writing prompts for it, and you cannot get it from a summary after the fact.
The other reason is calibration. Approving fifty commands teaches you which categories you'd never have approved. Those are exactly the situations where you'll want Supervised again later.
Combining modes with worktrees#
The best of both: run Full Access, but confine the agent to a git worktree on a throwaway branch. The agent works uninterrupted, and anything it does is contained in a separate directory and branch you can delete. You review the diff before it reaches your main working tree.
That combination is the reason worktree support matters more than it first appears.
FAQ#
What is the difference between Full Access and Supervised mode in T3 Code?#
Full Access, the default, lets the agent run commands and modify files with no approval prompts. Supervised requires you to approve each command and file modification before it executes.
Is Full Access mode in T3 Code safe?#
It carries the same risk as running commands yourself, because the agent operates with your user's privileges — it can read your credentials and run anything you can. It's reasonable on trusted repositories, and safer still when combined with git worktree isolation.
Can I change the runtime mode after setup?#
Yes, runtime mode is a setting you can switch. Many people start on Supervised while learning the tool and move to Full Access once they trust the workflow.
Does Supervised mode sandbox the agent?#
No. Supervised mode adds approval prompts, it does not restrict what the agent is technically capable of doing. For real isolation, run T3 Code on a machine or container without sensitive credentials.