OOB “Email a link” command bar button from entity record generate an url along with current form id. When the recipient clicks that record url, then end up in the form which they don’t have access by their security role. Flaw!

Then they cannot switch to their original form as there is no form switcher. Please fix this by removing formid in url or check before loading the record form for the accessibility & switch it.

Full details & workaround in my blog:
https://arundynamix.blogspot.com/2018/10/email-link-custom-button-in-dynamics.html