Worth checking this out for details on the custom bearer approach to authentication: Custom Bearer Grant Type
Key part is ensuring the link you are sending is secure, and the user clicking the link actually has access to that assignment.
Providing global public access by using the activity to just set an operator would not be recommended and as mentioned in other comments can cause security concerns - consider how you will decide if the user is actually allowed to click the link.