You can find all the OP_DROP and OP_RETURN metadata formats documented on these pages:
http://www.multichain.com/developers/permissions-management/
http://www.multichain.com/developers/native-assets/
I recommend also looking at the raw content of transactions created with the issue and grant APIs to make sure they match your understanding of those pages.
And yes, it is possible to combine asset and permission operations in one transaction output with multiple OP_DROP opcodes and payloads.