Postgres usage of session identifiers for security

Can anyone describe how Postgres generates session identifiers and how
Postgres uses a session identifier for community action protection?

More specifically, will Postgres allow a session identifier to be
non-system generated? How does Postgres respond when presented with a
non-system generated session identifier?

My security team is asking and I can't find any documentation on this.

Thanks,
Keith