I have a user who has permission to view activity in a particular stream. The stream outputs activity messages with the time (eg: "4 min ago"), which links to heartbeat/message/[ID] . The user receives a 403 access denied error when clicking the link.

If the user doesn't have permission to view the link's destination, then there should be no link.