What is a SAML assertion, conceptually?

A claim about a subject that an asserting party (the IdP) makes to a relying party (the SP), packaged so the relying party can verify who said it and act on it.

An assertion is not a session cookie or a password; it is a statement made by a third party. Think of it like a letter of introduction signed by someone you trust: "the bearer is Alice, I checked her ID at 09:23, she belongs to the finance department". Its value depends entirely on whether the relying party trusts the issuer and can check the signature.

Every assertion:

• is issued by one asserting party (named in <Issuer>),
• is about exactly one subject (an identity, named in <Subject>),
• contains one or more statements about that subject (authentication, attribute or authorisation decision),
• carries conditions (validity period, intended audience) and normally a digital signature.

The relying party decides, based on that statement, whether to create a local session and what the user may do.

Go deeper:

• SAML 2.0: Assertions (Wikipedia) — an annotated real assertion element by element.
• OASIS: SAML V2.0 Core specification (PDF) — section 2 defines the assertion schema normatively.