Quick answer
Check whether the step is assigned to an email field or a WordPress user. A tokenized email-assignee link can behave differently when opened inside an existing user session. Compare the intended access paths with fictional identities in separate browser sessions. Do not fix the symptom by granting broader roles or making the workflow inbox public.
Start with the intended participant model
An external client without a site account and an employee with a WordPress login may share the same contact address format, but they are different workflow participants. Write down which model the business intends for the affected step. Then inspect the actual assignment configuration, not just the recipient shown in the email.
Record the form, entry, and step identifiers in a private support note. Confirm whether the step is still active for that participant. A link to work that another reviewer already completed may legitimately stop offering an edit action. That outcome should not be mistaken for an authentication failure.
Check the destination before changing permissions
Inspect the configured message template and inbox page. The destination must belong to the correct site and environment and provide the intended workflow interface. A staging import can leave a message pointing to an old page or a production hostname. Check the page identity without publishing or forwarding the access token.
Do not send the full link through public link checkers, screenshot tools, chat channels, or URL shorteners. Treat it as access-bearing data. A redacted path plus the assignment type is usually enough for initial diagnosis. If a support person needs access, use the organization's approved support process rather than sharing a client's live token.
Create a controlled identity matrix
On staging, use one fictional email participant, one intended WordPress test user, and one unrelated test user. Keep outgoing mail in a test inbox and remove production integrations. Record the exact step state before each access attempt so changes from an earlier test do not contaminate the next result.
Compare a clean private session with a session authenticated as the intended user. Check what entry and action the page displays, not only whether it returns a successful HTTP status. A generic login page or empty inbox can return 200 without giving the participant the promised workflow action.
Choose assignment deliberately
Gravity Flow recommends user selection when the participant is an existing WordPress user, and documents special considerations for email-field assignees. Apply that guidance to the intended business model rather than replacing every external email participant with a new site account. The correct choice depends on how the person is meant to participate.
If assignment changes are needed, test editable fields, visible fields, and completion rights alongside the link. Do not assume changing the email notification also changes who owns the task. Keep role membership and permission changes under the appropriate account owner's review.
Include negative and completed-entry tests
A passing test means the intended participant can act on the intended entry, and an unrelated account cannot. Check both. Also test the message after the step is completed, when another permitted reviewer finishes first, and when a user opens an older message. Record the expected explanation or unavailable-action state.
Use separate fictional entries when testing approval or completion because those actions can advance the workflow. Reusing one entry across every scenario can create misleading failures. Do not repeatedly reset it without accounting for messages or external actions that a restart might generate.
Deploy the smallest reviewed correction
The fix may be the assignment type, destination page, or notification link configuration. Change only the layer supported by the evidence, then run the same identity matrix against an approved production test entry. Keep the test non-sensitive and coordinate with the people responsible for the workflow.
Give recipients clear instructions that match their actual access model. Avoid telling everyone to log out permanently as the final repair for a configuration mismatch. Keep a redacted record of the old and new setup, remove temporary accounts through the approved process, and check that no test access remains. The outcome should be predictable access with the existing privacy boundary intact.
Illustrative diagnostic example, not customer measurements.When to bring in help
Use Gravity Flow access troubleshooting when client entry links behave differently across sessions. Share the assignment type, page path, and redacted results. Never include the full tokenized URL or grant an external participant administrator access to make a test pass.
Related troubleshooting
Review assignee routing and editable-field access.
Helpful references
Gravity Flow User Input settings.