citadel/meta-citadel/recipes-citadel/citadel-config/files/polkit/citadel.rules

polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.NetworkManager.settings.modify.system" ||
        action.id == "org.freedesktop.machine1.host-open-pty") &&
        subject.local && subject.isInGroup("citadel")) {
            return polkit.Result.YES;
    }
});