General users won't have access to SOST in live system - no Security admin will provide that. This is because, SOST is not a business transaction.
What I had done for addressing this was:
The email was created by custom output type.
Hence, I knew what was the email object generated.
Once the email is generated, I linked the send request object with the business object (in my case it was sales order), using binary relation.
So, the next time, the users went into VA0x transaction, and clicked on the GOS button, they had the email listed under relationships option and were able to view the email from there.
Thanks,
Juwin