Admin Module with highly customized UI
Have a look at hook_menu(). It's the cornerstone to define pathes and who has access to them.

In drupal you define a path by implementing hook_menu in a custom module. There you define what php functions are called and what user roles do have access to it. This way you can route your AJAX calls through drupal autentication and authorisation.