diff --git a/src/main/runtime/rpc/rpc-caller-scope.ts b/src/main/runtime/rpc/rpc-caller-scope.ts
index b44b8d8c2a2..ecb1a0fb430 100644
--- a/src/main/runtime/rpc/rpc-caller-scope.ts
+++ b/src/main/runtime/rpc/rpc-caller-scope.ts
@@ -29,7 +29,9 @@ export const OWNER_RPC_CALLER_SCOPE: RpcCallerScope = { kind: 'owner' }
 
 // Why: a paired desktop, web client or `--host runtime:` CLI is this runtime's full remote UI, so its
 // standard set covers what that UI drives here (settings, accounts, skills, SSH and server updates).
-// Everything else (desktop control, pairing and push admin) is refused unless granted at pairing.
+// None of these exceeds `workspace`, which already runs commands as the user (see
+// rpc-method-permission.ts). Desktop control needs a grant at pairing; pairing admin is never
+// granted to this row.
 const RUNTIME_PAIRED_STANDARD: ReadonlySet<RpcMethodPermission> = new Set([
   'workspace',
   'settings-write',
diff --git a/src/main/runtime/rpc/rpc-method-permission.ts b/src/main/runtime/rpc/rpc-method-permission.ts
index 43d06460f62..bc4ab5270f0 100644
--- a/src/main/runtime/rpc/rpc-method-permission.ts
+++ b/src/main/runtime/rpc/rpc-method-permission.ts
@@ -3,9 +3,18 @@
  *
  * The dispatcher grants each caller kind a set of these (rpc-caller-scope.ts), so a new method
  * cannot ship without someone deciding which callers may reach it.
+ *
+ * `workspace` means the caller can run code as this host's user: it opens terminals and starts
+ * agents here. Anything a terminal command could do anyway (browsing directories, installing
+ * skills, changing launch env or SSH targets) is therefore not a boundary for a `workspace`
+ * caller. Those stay separate tiers so a narrower row (an SSH host's CLI) can refuse them; mobile
+ * is gated by its own method-name allowlist instead. For a paired runtime client the real
+ * boundaries are `desktop-control` (granted per device at pairing) and `pairing-admin` (never
+ * granted to it).
  */
 export type RpcMethodPermission =
-  /** Projects, worktrees, terminals, files, git, browser, orchestration and integrations. */
+  /** Projects, worktrees, terminals, files, git, browser, orchestration and integrations; equals
+   *  running commands as this host's user. */
   | 'workspace'
   /** Drives this machine's own desktop: clicks, keys and app state outside Orca. */
   | 'desktop-control'
diff --git a/src/renderer/src/components/settings/RuntimePairingGeneratorForm.tsx b/src/renderer/src/components/settings/RuntimePairingGeneratorForm.tsx
index 1c5176a999c..8fed6b1f1d1 100644
--- a/src/renderer/src/components/settings/RuntimePairingGeneratorForm.tsx
+++ b/src/renderer/src/components/settings/RuntimePairingGeneratorForm.tsx
@@ -305,7 +305,13 @@ export function RuntimePairingGeneratorForm({
             )}
           </div>
         ) : null}
-        <div className="flex justify-end">
+        <div className="flex items-center justify-between gap-3">
+          <p className="text-xs text-muted-foreground">
+            {translate(
+              'auto.components.settings.RuntimePairingUrlGenerator.pairedRunsAsYou',
+              'A paired client can run commands as you on this computer.'
+            )}
+          </p>
           <Button
             type="button"
             size="sm"
diff --git a/src/renderer/src/components/sidebar/AddRemoteHostServerFormPanel.tsx b/src/renderer/src/components/sidebar/AddRemoteHostServerFormPanel.tsx
index 735b1bda66a..124bec718a9 100644
--- a/src/renderer/src/components/sidebar/AddRemoteHostServerFormPanel.tsx
+++ b/src/renderer/src/components/sidebar/AddRemoteHostServerFormPanel.tsx
@@ -58,6 +58,13 @@ export function AddRemoteHostServerFormPanel({
         onSubmit={onSubmit}
       />
 
+      <p className="text-xs text-muted-foreground">
+        {translate(
+          'auto.components.sidebar.AddRemoteHostDialog.serverRunsAsYou',
+          'This device will be able to run commands as you on this server.'
+        )}
+      </p>
+
       <DialogFooter className="sm:justify-between">
         <span />
         <div className="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 5b9378d6efe..3e7b0a2160c 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -6452,6 +6452,7 @@
           "serverTitle": "Add remote server",
           "sshTitle": "Add SSH host",
           "serverDescription": "Pair with Orca running on another computer.",
+          "serverRunsAsYou": "This device will be able to run commands as you on this server.",
           "sshDescription": "Add a persistent machine you can log into over SSH.",
           "cancel": "Cancel",
           "saving": "Saving...",
@@ -8529,6 +8530,7 @@
           "de6d5cff95": "This computer (",
           "de77eb1b65": "Connection address",
           "ff80904fc4": "Create a revocable access grant for browser or desktop clients.",
+          "pairedRunsAsYou": "A paired client can run commands as you on this computer.",
           "f8500e134a": "Share this Orca server",
           "d6c081adf4": "Failed to copy URL.",
           "df0aa45a86": "Copied pairing URL.",
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 456eefb9692..ac8fb85b72d 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -6235,6 +6235,7 @@
           "serverTitle": "Agregar servidor remoto",
           "sshTitle": "Agregar host SSH",
           "serverDescription": "Empareja con Orca ejecutándose en otro equipo.",
+          "serverRunsAsYou": "Este dispositivo podrá ejecutar comandos como tú en este servidor.",
           "sshDescription": "Agrega una máquina persistente donde puedas iniciar sesión por SSH.",
           "cancel": "Cancelar",
           "saving": "Guardando...",
@@ -8240,6 +8241,7 @@
           "de6d5cff95": "Esta computadora (",
           "de77eb1b65": "Dirección de conexión",
           "ff80904fc4": "Crea una concesión de acceso revocable para clientes de navegador o escritorio.",
+          "pairedRunsAsYou": "Un cliente emparejado puede ejecutar comandos como tú en este equipo.",
           "f8500e134a": "Compartir este servidor Orca",
           "d6c081adf4": "No se pudo copiar la URL.",
           "df0aa45a86": "URL de emparejamiento copiada.",
diff --git a/src/renderer/src/i18n/locales/fr.json b/src/renderer/src/i18n/locales/fr.json
index ce52605ddbb..ed257372afb 100644
--- a/src/renderer/src/i18n/locales/fr.json
+++ b/src/renderer/src/i18n/locales/fr.json
@@ -6315,6 +6315,7 @@
           "serverTitle": "Ajouter un serveur distant",
           "sshTitle": "Ajouter un hôte SSH",
           "serverDescription": "Se jumeler avec Orca exécuté sur un autre ordinateur.",
+          "serverRunsAsYou": "Cet appareil pourra exécuter des commandes en votre nom sur ce serveur.",
           "sshDescription": "Ajoutez une machine permanente sur laquelle vous pouvez vous connecter en SSH.",
           "cancel": "Annuler",
           "saving": "Enregistrement...",
@@ -8384,6 +8385,7 @@
           "de6d5cff95": "Cet ordinateur (",
           "de77eb1b65": "Adresse de connexion",
           "ff80904fc4": "Créez un droit d'accès révocable pour les clients navigateur ou bureau.",
+          "pairedRunsAsYou": "Un client jumelé peut exécuter des commandes en votre nom sur cet ordinateur.",
           "f8500e134a": "Partager ce serveur Orca",
           "d6c081adf4": "Échec de la copie de l'URL.",
           "df0aa45a86": "URL d'appairage copiée.",
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index 025459df0bb..227575da986 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -6235,6 +6235,7 @@
           "serverTitle": "リモートサーバーを追加する",
           "sshTitle": "SSH ホストを追加",
           "serverDescription": "別のコンピュータで実行されている Orca とペアリングします。",
+          "serverRunsAsYou": "このデバイスは、このサーバー上であなたとしてコマンドを実行できるようになります。",
           "sshDescription": "SSH でログインできる永続的なマシンを追加します。",
           "cancel": "キャンセル",
           "saving": "保存中…",
@@ -8262,6 +8263,7 @@
           "de6d5cff95": "このコンピュータ (",
           "de77eb1b65": "接続アドレス",
           "ff80904fc4": "ブラウザまたはデスクトップクライアントに対する取り消し可能なアクセス許可を作成します。",
+          "pairedRunsAsYou": "ペアリングしたクライアントは、このコンピュータ上であなたとしてコマンドを実行できます。",
           "f8500e134a": "この Orca サーバーを共有する",
           "d6c081adf4": "URLのコピーに失敗しました。",
           "df0aa45a86": "ペアリング URL をコピーしました。",
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index fd645794b9a..62d63f3bf3a 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -6235,6 +6235,7 @@
           "serverTitle": "원격 서버 추가",
           "sshTitle": "SSH 호스트 추가",
           "serverDescription": "다른 컴퓨터에서 실행 중인 Orca와 페어링합니다.",
+          "serverRunsAsYou": "이 기기는 이 서버에서 사용자 권한으로 명령을 실행할 수 있게 됩니다.",
           "sshDescription": "SSH를 통해 로그인할 수 있는 영구 머신을 추가합니다.",
           "cancel": "취소",
           "saving": "저장 중...",
@@ -8225,6 +8226,7 @@
           "de6d5cff95": "이 컴퓨터(",
           "de77eb1b65": "연결 주소",
           "ff80904fc4": "브라우저 또는 데스크톱 클라이언트에 대해 취소 가능한 액세스 권한을 만듭니다.",
+          "pairedRunsAsYou": "페어링된 클라이언트는 이 컴퓨터에서 사용자 권한으로 명령을 실행할 수 있습니다.",
           "f8500e134a": "이 Orca 서버 공유",
           "d6c081adf4": "URL을 복사하지 못했습니다.",
           "df0aa45a86": "페어링 URL을 복사했습니다.",
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index a78155345c8..047297a13d9 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -6235,6 +6235,7 @@
           "serverTitle": "添加远程服务器",
           "sshTitle": "添加 SSH 主机",
           "serverDescription": "与另一台电脑上运行的 Orca 配对。",
+          "serverRunsAsYou": "此设备将能够在此服务器上以你的身份运行命令。",
           "sshDescription": "添加一台可通过 SSH 登录并持久保存的机器。",
           "cancel": "取消",
           "saving": "正在保存...",
@@ -8225,6 +8226,7 @@
           "de6d5cff95": "这台电脑（",
           "de77eb1b65": "连接地址",
           "ff80904fc4": "为浏览器或桌面客户端创建可撤销的访问授权。",
+          "pairedRunsAsYou": "已配对的客户端可以在此电脑上以你的身份运行命令。",
           "f8500e134a": "分享此 Orca 服务器",
           "d6c081adf4": "复制 URL 失败。",
           "df0aa45a86": "复制的配对 URL。",