Devin is right. Emailing a shortcut does not bypass any of the security in the system. If the user doesn't have the rights to see the document then the shortcut won't be able to open the document up either. One way to get the best of both worlds here is by using an effective security design. Access rights in the Laserfiche client have a very flexible range of scope which allows you to apply security just the way you want it. For example, you can grant the entry access rights of "read" on a subfolder without granting any rights to the folder(s) above it. This will allow users to open documents in the subfolder (shortcuts will work too) but not have the ability to see or browse to the subfolder normally. Security can get a little confusing if you're not too familiar with how it works so I recommend checking out the help files and of course test new configuration settings before you push it to the production environment!