How can I allow web applications and batch applications to access secure Assets?



My company needs to allow non-AEM web sites to access files stored in AEM Assets.  One particular web application is a "forms admin" site that will need to pull multiple PDFs from the DAM (based on user-entered criteria) and download those files for the user.  The files will be secure and only available to users or applications with the correct permissions.  Similarly, we will need Java batch applications to have similar functionality.  The apps would likely have the path to the assets it needs to download.

How should these applications connect to AEM?  How should it be authorized and authenticated?