Reading at question How can I make shutdown not require admin password?, and in particular Epeli's answer, I see a problem. The unprivileged user can always shutdown/restart the computer, regardless of the policies defined by PolicyKit, just using the ConsoleKit:
dbus-send --system --print-reply --dest="org.freedesktop.ConsoleKit" /org/freedesktop/ConsoleKit/Manager org.freedesktop.ConsoleKit.Manager.Stop
Isn't this a security issue? Or I'm missing something?