Though, conceptually it's quite easy.
Add custom link to menu in admin
When link is clicked, it opens an iframe URL in a modular window.
The URL contains an encrypted payload in the URL parameter.
The receiving back-end then decrypt the payload using a secret key.
The payload contains basic JSON that contains a session key.
The session key can be verified by POSTin to an Appdrag Endpoint to verify it's still valid (encrypted payload here too).
Since we're encrypting the payload using a secret, no man-in-the-middle can temper with the content and since we're posting only a current session key, the session lifetime can be limited and verified even on the back-end side.
Not what I had in mind for the asset manager though.
Update: You're right, for it to be usable it would need to be it's own library and you'd need to make "custom apps" as mentioned above, available, which I expect you don't have plans for.