Going to be difficult to go into too much detail in this thread but I'll try.
From the ASA side:
The base configuration for the ASA consists of the global webvpn configuration, tunnel-group and group-policy configuration. The webvpn configuration defines global settings like what port and interface webvpn needs to be enabled along with what minimum AnyConnect client version is required by ASA admin.
Next, simply put, the tunnel-group defines what sort of authentication has to take place for the user, while the group-policy defines what sort of permissions and settings the user receives after authentication (authorization).
So when a user connects, they would hit a tunnel-group, authenticate based on the AAA or cert method defined there. They would then receive attributes defined in the group-policy assigned to them (dynamically or statically in the tunnel-group). This is where split tunnels, filters etc take effect.
Post this, sessions (tunnels) is created on the ASA - a Parent , TLS and/or DTLS. Internally the ASA's keep classification rules to match traffic to send across the tunnel.
From the client side:
Post authentication and tunnel establishment, the client enables the AnyConnect virtual adapter and installs the routes (default or split tunnel networks). This basically redirects the traffic to the adapter, which then tunnels it to the ASA.
I hope this was what you were looking for.
