I have seen a 'trusted links' concept in production: imagine you have news stories (or similar) behind a paywall. You send out emails to your customers with dir

I have seen a 'trusted links' concept in production: imagine you have news stories (or similar) behind a paywall. You send out emails to your customers with direct story links that include a token which bypasses the paywall. Optionally, have that link log the user in a low-trust context where step-up auth is required to do e.g. account management.