You do not have access to the Google Account that is used on the Google Assistant. You also don't have access to the local storage of the device the Assistant is running on - keep in mind that they can access the Assistant from multiple devices at once.
As part of the information your webhook is sent through the Assistant, you can get a unique, but anonymous, UserID which you can treat similarly to a web cookie. Unless the user takes a deliberate action to revoke this ID, it will be consistent for this person across all devices their account is tied to through the Assistant.
You can use this ID to store information about or for the user in a database (for example, Firebase Database) in the cloud or on your servers, since the next time they use your service they will present with the same ID, but you can't directly send it back to be stored on the user's Android or iOS device. Since users can access the Assistant (and, therefore, your Action) across multiple devices, this may be a good thing.
There is, additionally, a Session ID available. As you surmise, this is new for each session and not tied to a user. There are some cases where it will produce a new UserID for each session, but these are cases where the user is using a generic/default account on their Google Home, so you couldn't trust that the physical person returning was the same as the one that contacted you before.
Account linking may help you in some cases, but requires a great deal of extra work. If you link their Assistant account "your" account, and your account has permission to send them something like a Firebase Cloud Message, you might be able to write an app that runs on the device and handles the FCM by storing the data in local storage.