Why does the recipient see "Access denied"?

Theo sends a test renewal notification to Rashida. The email lands fine, but when Rashida clicks the contract link she sees the SharePoint "Access denied" page.

What's the most likely cause?