A SAML assertion is the XML document issued by the IdP to the SP containing the user's identity information. It contains three types of statements: 1) Authentication statements - confirming the user authenticated at a specific time with a specific method (password, MFA, etc.). 2) Attribute statements - containing user properties like email, department, role that the SP needs for authorization. 3) Authorization decision statements - less common, stating whether the user is permitted to access a specific resource (though SPs typically make their own authorization decisions). Assertions are digitally signed by the IdP and may be encrypted for confidentiality.