How is client access dealt with?

How is client access dealt with? In other words, I want my client to receive e-mail notification of things to review and give comments.

What we have in the queue are special approval pages for clients, directors, producers, or basically anyone who you don't want seeing the innards of your project. This would also be good for anyone who needs to be spoon fed exactly what to look at with a minimum of complexity.

Your client would get an email message with a link. He clicks on the link, might optionally sign in, and then sees a page with: a note from the supervisor, the asset(s) for review, and a place to type in comments. There would also be a checkbox for "Approved" -- I'm thinking I would fill in the date and time that he hits the checkbox, and keep a record of that.

QUESTION: Should the email link have an authentication code built-in? Or is that too much of a security risk and we need to make the client log in to a session?