Generate a read-only link per project. Your client sees the timeline and leaves comments — never anything internal.