Hi @loparev, thanks for having a look at this!
As you already figured out yourself, the key isn't only used for previewing but also for accessing the source URL (JobItem::getSourceUrl). Granting the access is done in tmgmt_content_entity_access.
You are correct about the "View published content" permission, when that one is disabled the tmgmt functionality isn't working either. Drupal core seems to force this behavior (NodeAccessControlHandler::access) and doesn't allow alteration. When we want to follow tmgmt strategy we should implement the same access logic on job item, thats why we need the item and not the job alone.
We already tried https://git.drupalcode.org/project/tmgmt_smartling/-/merge_requests/29/d... but that didn't work either. The session cookie that is generated is still lacking an ID, like this: SSESSc2b280e207aa821b24606f896b740d6d=.
Have you tried using the contextUsername with tmgmt anonymous_access disabled? Can you verify if the session cookie is build correctly?