Postgres usage of session identifiers for security

Can anyone describe how Postgres generates session identifiers and how Postgres uses a session identifier for community action protection?

More specifically, will Postgres allow a session identifier to be non-system generated?  How does Postgres respond when presented with a non-system generated session identifier?

My security team is asking and I can't find any documentation on this.

Thanks,
Keith