diff --git a/src/Makefile.am b/src/Makefile.am
index c4808e6..554d6eb 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -17,6 +17,7 @@ nm_applet_CPPFLAGS = \
 	-DVPN_NAME_FILES_DIR=\""$(sysconfdir)/NetworkManager/VPN"\"	\
 	-DNMALOCALEDIR=\"$(datadir)/locale\"					\
 	$(DBUS_CFLAGS)										\
+	$(POLKIT_CFLAGS) \
 	$(DISABLE_DEPRECATED)	\
 	-I${top_builddir}/src/marshallers \
 	-I${top_srcdir}/src/utils \
@@ -68,6 +69,7 @@ nm_applet_LDADD = \
 	$(GCONF_LIBS) \
 	$(GNOME_KEYRING_LIBS) \
 	$(NOTIFY_LIBS) \
+	$(POLKIT_LIBS) \
 	${top_builddir}/src/marshallers/libmarshallers.la \
 	${top_builddir}/src/utils/libutils.la \
 	${top_builddir}/src/gconf-helpers/libgconf-helpers.la \
diff --git a/src/applet-device-cdma.c b/src/applet-device-cdma.c
index bd13d13..c0d3b2e 100644
--- a/src/applet-device-cdma.c
+++ b/src/applet-device-cdma.c
@@ -91,6 +91,7 @@ cdma_menu_item_info_destroy (gpointer data)
 typedef struct {
 	AppletNewAutoConnectionCallback callback;
 	gpointer callback_data;
+	NMApplet *applet;
 } AutoCdmaWizardInfo;
 
 static void
@@ -148,6 +149,11 @@ mobile_wizard_done (NMAMobileWizard *wizard,
 		              NULL);
 		g_free (uuid);
 		g_free (id);
+		if (info->applet->default_private)
+			nm_setting_connection_add_permission ((NMSettingConnection *)setting,
+			                                      "user",
+			                                      g_get_user_name(),
+			                                      NULL);
 		nm_connection_add_setting (connection, setting);
 	}
 
@@ -161,7 +167,8 @@ done:
 
 static gboolean
 do_mobile_wizard (AppletNewAutoConnectionCallback callback,
-                  gpointer callback_data)
+                  gpointer callback_data,
+                  NMApplet *applet)
 {
 	NMAMobileWizard *wizard;
 	AutoCdmaWizardInfo *info;
@@ -170,6 +177,7 @@ do_mobile_wizard (AppletNewAutoConnectionCallback callback,
 	info = g_malloc0 (sizeof (AutoCdmaWizardInfo));
 	info->callback = callback;
 	info->callback_data = callback_data;
+	info->applet = applet;
 
 	wizard = nma_mobile_wizard_new (NULL, NULL, NM_DEVICE_MODEM_CAPABILITY_CDMA_EVDO, FALSE,
 									mobile_wizard_done, info);
@@ -194,7 +202,9 @@ cdma_new_auto_connection (NMDevice *device,
                           AppletNewAutoConnectionCallback callback,
                           gpointer callback_data)
 {
-	return do_mobile_wizard (callback, callback_data);
+	CdmaMenuItemInfo *info = (CdmaMenuItemInfo *) dclass_data;
+
+	return do_mobile_wizard (callback, callback_data, info->applet);
 }
 
 static void
@@ -249,7 +259,7 @@ applet_cdma_connect_network (NMApplet *applet, NMDevice *device)
 	info->applet = applet;
 	info->device = g_object_ref (device);
 
-	do_mobile_wizard (dbus_connect_3g_cb, info);
+	do_mobile_wizard (dbus_connect_3g_cb, info, applet);
 }
 
 static void
diff --git a/src/applet-device-gsm.c b/src/applet-device-gsm.c
index a68f2a5..de6cfce 100644
--- a/src/applet-device-gsm.c
+++ b/src/applet-device-gsm.c
@@ -119,6 +119,7 @@ gsm_menu_item_info_destroy (gpointer data)
 typedef struct {
 	AppletNewAutoConnectionCallback callback;
 	gpointer callback_data;
+	NMApplet *applet;
 } AutoGsmWizardInfo;
 
 static void
@@ -177,6 +178,11 @@ mobile_wizard_done (NMAMobileWizard *wizard,
 		              NULL);
 		g_free (uuid);
 		g_free (id);
+		if (info->applet->default_private)
+			nm_setting_connection_add_permission ((NMSettingConnection *)setting,
+			                                      "user",
+			                                      g_get_user_name(),
+			                                      NULL);
 		nm_connection_add_setting (connection, setting);
 	}
 
@@ -190,7 +196,8 @@ done:
 
 static gboolean
 do_mobile_wizard (AppletNewAutoConnectionCallback callback,
-                  gpointer callback_data)
+                  gpointer callback_data,
+                  NMApplet *applet)
 {
 	NMAMobileWizard *wizard;
 	AutoGsmWizardInfo *info;
@@ -199,6 +206,7 @@ do_mobile_wizard (AppletNewAutoConnectionCallback callback,
 	info = g_malloc0 (sizeof (AutoGsmWizardInfo));
 	info->callback = callback;
 	info->callback_data = callback_data;
+	info->applet = applet;
 
 	wizard = nma_mobile_wizard_new (NULL, NULL, NM_DEVICE_MODEM_CAPABILITY_GSM_UMTS, FALSE,
 									mobile_wizard_done, info);
@@ -223,7 +231,9 @@ gsm_new_auto_connection (NMDevice *device,
                          AppletNewAutoConnectionCallback callback,
                          gpointer callback_data)
 {
-	return do_mobile_wizard (callback, callback_data);
+	GSMMenuItemInfo *info = (GSMMenuItemInfo *) dclass_data;
+
+	return do_mobile_wizard (callback, callback_data, info->applet);
 }
 
 static void
@@ -278,7 +288,7 @@ applet_gsm_connect_network (NMApplet *applet, NMDevice *device)
 	info->applet = applet;
 	info->device = g_object_ref (device);
 
-	do_mobile_wizard (dbus_connect_3g_cb, info);
+	do_mobile_wizard (dbus_connect_3g_cb, info, applet);
 }
 
 static void
diff --git a/src/applet-device-wifi.c b/src/applet-device-wifi.c
index 0612f12..509b266 100644
--- a/src/applet-device-wifi.c
+++ b/src/applet-device-wifi.c
@@ -462,6 +462,14 @@ _do_new_auto_connection (NMApplet *applet,
 		nm_connection_add_setting (connection, NM_SETTING (s_8021x));
 	}
 
+	s_con = nm_connection_get_setting_connection (connection);
+	if (!s_con) {
+		s_con = (NMSettingConnection *) nm_setting_connection_new ();
+		nm_connection_add_setting (connection, NM_SETTING (s_con));
+	}
+	if (applet->default_private)
+		nm_setting_connection_add_permission (s_con, "user", g_get_user_name(), NULL);
+
 	/* If it's an 802.1x connection, we need more information, so pop up the
 	 * Dialog Of Doom.
 	 */
diff --git a/src/applet-device-wimax.c b/src/applet-device-wimax.c
index 5a4a6c2..10e84aa 100644
--- a/src/applet-device-wimax.c
+++ b/src/applet-device-wimax.c
@@ -94,6 +94,8 @@ wimax_new_auto_connection (NMDevice *device,
 				  NM_SETTING_CONNECTION_UUID, uuid,
 				  NULL);
 	g_free (uuid);
+	if (info->applet->default_private)
+		nm_setting_connection_add_permission (s_con, "user", g_get_user_name(), NULL);
 
 	nm_connection_add_setting (connection, NM_SETTING (s_con));
 
diff --git a/src/applet-device-wired.c b/src/applet-device-wired.c
index 0980355..168c215 100644
--- a/src/applet-device-wired.c
+++ b/src/applet-device-wired.c
@@ -67,6 +67,7 @@ wired_new_auto_connection (NMDevice *device,
                            AppletNewAutoConnectionCallback callback,
                            gpointer callback_data)
 {
+	WiredMenuItemInfo *info = (WiredMenuItemInfo *) dclass_data;
 	NMConnection *connection;
 	NMSettingWired *s_wired = NULL;
 	NMSettingConnection *s_con;
@@ -86,6 +87,8 @@ wired_new_auto_connection (NMDevice *device,
 	              NM_SETTING_CONNECTION_UUID, uuid,
 	              NULL);
 	g_free (uuid);
+	if (info->applet->default_private)
+		nm_setting_connection_add_permission (s_con, "user", g_get_user_name(), NULL);
 
 	nm_connection_add_setting (connection, NM_SETTING (s_con));
 
diff --git a/src/applet.c b/src/applet.c
index 47ce4bf..42aaa2e 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -3245,6 +3245,25 @@ import_cb (NMConnection *connection, gpointer user_data)
 	}
 }
 
+static void
+check_authorization_cb (PolkitAuthority *authority,
+                        GAsyncResult *res,
+                        gpointer user_data)
+{
+	PolkitAuthorizationResult *result;
+	NMApplet *applet = user_data;
+	GError *error;
+
+	error = NULL;
+	result = polkit_authority_check_authorization_finish (authority, res, &error);
+	if (error != NULL) {
+		g_warning ("Failed to check authorization: %s", error->message);
+		g_error_free (error);
+	} else if (polkit_authorization_result_get_is_authorized (result)) {
+		applet->default_private = FALSE;
+	}
+}
+
 static GObject *
 constructor (GType type,
              guint n_props,
@@ -3276,6 +3295,18 @@ constructor (GType type,
 	                      GCONF_CLIENT_PRELOAD_ONELEVEL,
 	                      NULL);
 
+	applet->default_private = TRUE;
+	applet->authority = polkit_authority_get_sync (NULL, NULL);
+	applet->subject = polkit_unix_process_new (getpid ());
+	polkit_authority_check_authorization (applet->authority,
+	                                      applet->subject,
+	                                      "org.freedesktop.NetworkManager.settings.modify.system",
+	                                      NULL,
+	                                      POLKIT_CHECK_AUTHORIZATION_FLAGS_NONE,
+	                                      NULL,
+	                                      (GAsyncReadyCallback) check_authorization_cb,
+	                                      applet);
+
 	/* Load pixmaps and create applet widgets */
 	if (!setup_widgets (applet))
 		goto error;
@@ -3376,6 +3407,12 @@ static void finalize (GObject *object)
 		g_object_unref (applet->gconf_client);
 	}
 
+	if (applet->authority)
+		g_object_unref (applet->authority);
+
+	if (applet->subject)
+		g_object_unref (applet->subject);
+
 	if (applet->status_icon)
 		g_object_unref (applet->status_icon);
 
diff --git a/src/applet.h b/src/applet.h
index a9d07bc..52e9765 100644
--- a/src/applet.h
+++ b/src/applet.h
@@ -36,6 +36,8 @@
 #include <dbus/dbus-glib.h>
 #include <net/ethernet.h>
 
+#include <polkit/polkit.h>
+
 #include <libnotify/notify.h>
 
 #include <nm-connection.h>
@@ -90,6 +92,10 @@ typedef struct
 
 	GConfClient *	gconf_client;
 
+	PolkitSubject *subject;
+	PolkitAuthority *authority;
+	gboolean default_private;
+
 	/* Permissions */
 	NMClientPermissionResult permissions[NM_CLIENT_PERMISSION_LAST + 1];
 
diff --git a/src/connection-editor/Makefile.am b/src/connection-editor/Makefile.am
index 59d2b50..c449d4f 100644
--- a/src/connection-editor/Makefile.am
+++ b/src/connection-editor/Makefile.am
@@ -11,6 +11,7 @@ nm_connection_editor_CPPFLAGS = \
 	-DDATADIR=\""$(datadir)"\" \
 	-DNMALOCALEDIR=\"$(datadir)/locale\" \
 	$(DBUS_CFLAGS) \
+	$(POLKIT_CFLAGS) \
 	$(DISABLE_DEPRECATED) \
 	-I${top_srcdir}/src/utils \
 	-I${top_srcdir}/src/wireless-security \
@@ -66,6 +67,7 @@ nm_connection_editor_LDADD = \
 	${top_builddir}/src/libnm-gtk/libnm-gtk.la \
 	$(GTK_LIBS) \
 	$(NMA_LIBS) \
+	$(POLKIT_LIBS) \
 	-lm
 
 uidir = $(datadir)/nm-applet
diff --git a/src/connection-editor/ce-page.c b/src/connection-editor/ce-page.c
index 44fd952..103453a 100644
--- a/src/connection-editor/ce-page.c
+++ b/src/connection-editor/ce-page.c
@@ -29,6 +29,8 @@
 
 #include <glib/gi18n.h>
 
+#include <polkit/polkit.h>
+
 #include <nm-setting-connection.h>
 #include <nm-utils.h>
 
@@ -494,6 +496,10 @@ ce_page_new_connection (const char *format,
 	NMSettingConnection *s_con;
 	char *uuid, *id;
 	GSList *connections;
+	PolkitSubject *subject;
+	PolkitAuthority *authority;
+	PolkitAuthorizationResult *result;
+	GError *error = NULL;
 
 	connection = nm_connection_new ();
 
@@ -516,6 +522,34 @@ ce_page_new_connection (const char *format,
 	g_free (uuid);
 	g_free (id);
 
+	/* Check the polkit authorization */
+	authority = polkit_authority_get_sync (NULL, NULL);
+	subject = polkit_unix_process_new (getpid ());
+	result = polkit_authority_check_authorization_sync (authority,
+	                                                    subject,
+	                                                    "org.freedesktop.NetworkManager.settings.modify.system",
+	                                                    NULL,
+	                                                    POLKIT_CHECK_AUTHORIZATION_FLAGS_NONE,
+	                                                    NULL,
+	                                                    &error);
+	if (error || !result) {
+		g_warning ("%s: failed to check polkit authorization! %s", __func__,
+		           error ? error->message : "(unknown)");
+		g_clear_error (&error);
+		nm_setting_connection_add_permission (s_con,
+		                                      "user",
+		                                      g_get_user_name(),
+		                                      NULL);
+	} else if (!polkit_authorization_result_get_is_authorized (result)) {
+		nm_setting_connection_add_permission (s_con,
+		                                      "user",
+		                                      g_get_user_name(),
+		                                      NULL);
+	}
+	g_object_unref (result);
+	g_object_unref (authority);
+	g_object_unref (subject);
+
 	return connection;
 }
 
diff --git a/src/gnome-bluetooth/Makefile.am b/src/gnome-bluetooth/Makefile.am
index b5f93f0..ccaf633 100644
--- a/src/gnome-bluetooth/Makefile.am
+++ b/src/gnome-bluetooth/Makefile.am
@@ -7,6 +7,7 @@ INCLUDES = \
 	-I${top_srcdir}/src/utils \
 	-I${top_srcdir}/src/libnm-gtk \
 	$(GNOME_BLUETOOTH_CFLAGS) \
+	$(POLKIT_CFLAGS) \
 	$(DISABLE_DEPRECATED) \
 	$(WARN_CFLAGS)
 
@@ -25,6 +26,7 @@ libnma_la_LIBADD = \
 	$(top_builddir)/src/marshallers/libmarshallers.la \
 	$(top_builddir)/src/utils/libutils.la \
 	$(top_builddir)/src/libnm-gtk/libnm-gtk.la \
+	$(POLKIT_LIBS) \
 	$(GNOME_BLUETOOTH_LIBS)
 endif
 
diff --git a/src/gnome-bluetooth/bt-widget.c b/src/gnome-bluetooth/bt-widget.c
index 32b3af5..204827d 100644
--- a/src/gnome-bluetooth/bt-widget.c
+++ b/src/gnome-bluetooth/bt-widget.c
@@ -48,6 +48,8 @@
 #include <dbus/dbus.h>
 #include <dbus/dbus-glib.h>
 
+#include <polkit/polkit.h>
+
 #include "nma-marshal.h"
 #include "nm-mobile-wizard.h"
 
@@ -72,6 +74,10 @@ typedef struct {
 	BluetoothClient *btclient;
 	GtkTreeModel *btmodel;
 
+	PolkitSubject *subject;
+	PolkitAuthority *authority;
+	gboolean default_private;
+
 	gboolean pan;
 	GtkWidget *pan_button;
 	guint pan_toggled_id;
@@ -256,6 +262,11 @@ add_pan_connection (PluginInfo *info)
 	              NULL);
 	g_free (id);
 	g_free (uuid);
+	if (info->default_private)
+		nm_setting_connection_add_permission ((NMSettingConnection *)setting,
+		                                      "user",
+		                                      g_get_user_name(),
+		                                      NULL);
 	nm_connection_add_setting (connection, setting);
 
 	/* The Bluetooth settings */
@@ -379,7 +390,8 @@ dun_error (PluginInfo *info, const char *func, GError *error, const char *fallba
 }
 
 static NMConnection *
-dun_new_cdma (NMAMobileWizardAccessMethod *method)
+dun_new_cdma (NMAMobileWizardAccessMethod *method,
+              PluginInfo *info)
 {
 	NMConnection *connection;
 	NMSetting *setting;
@@ -421,13 +433,19 @@ dun_new_cdma (NMAMobileWizardAccessMethod *method)
 	              NULL);
 	g_free (uuid);
 	g_free (id);
+	if (info->default_private)
+		nm_setting_connection_add_permission ((NMSettingConnection *)setting,
+		                                      "user",
+		                                      g_get_user_name(),
+		                                      NULL);
 	nm_connection_add_setting (connection, setting);
 
 	return connection;
 }
 
 static NMConnection *
-dun_new_gsm (NMAMobileWizardAccessMethod *method)
+dun_new_gsm (NMAMobileWizardAccessMethod *method,
+             PluginInfo *info)
 {
 	NMConnection *connection;
 	NMSetting *setting;
@@ -470,6 +488,11 @@ dun_new_gsm (NMAMobileWizardAccessMethod *method)
 	              NULL);
 	g_free (uuid);
 	g_free (id);
+	if (info->default_private)
+		nm_setting_connection_add_permission ((NMSettingConnection *)setting,
+		                                      "user",
+		                                      g_get_user_name(),
+		                                      NULL);
 	nm_connection_add_setting (connection, setting);
 
 	return connection;
@@ -513,9 +536,9 @@ wizard_done_cb (NMAMobileWizard *self,
 	}
 
 	if (method->devtype == NM_DEVICE_MODEM_CAPABILITY_CDMA_EVDO)
-		connection = dun_new_cdma (method);
+		connection = dun_new_cdma (method, info);
 	else if (method->devtype == NM_DEVICE_MODEM_CAPABILITY_GSM_UMTS)
-		connection = dun_new_gsm (method);
+		connection = dun_new_gsm (method, info);
 	else {
 		dun_error (info, __func__, NULL, _("Unknown phone device type (not GSM or CDMA)"));
 		return;
@@ -949,6 +972,10 @@ plugin_info_destroy (gpointer data)
 	                                      G_SIGNAL_MATCH_DATA, 0, 0, NULL,
 	                                      NULL, info);
 	g_object_unref (info->btclient);
+	if (info->authority)
+		g_object_unref (info->authority);
+	if (info->subject)
+		g_object_unref (info->subject);
 
 	if (info->bus)
 		dbus_g_connection_unref (info->bus);
@@ -1041,6 +1068,25 @@ out:
 	return running;
 }
 
+static void
+check_authorization_cb (PolkitAuthority *authority,
+                        GAsyncResult *res,
+                        gpointer user_data)
+{
+	PolkitAuthorizationResult *result;
+	PluginInfo *info = user_data;
+	GError *error;
+
+	error = NULL;
+	result = polkit_authority_check_authorization_finish (authority, res, &error);
+	if (error != NULL) {
+		g_warning ("Failed to check authorization: %s", error->message);
+		g_error_free (error);
+	} else if (polkit_authorization_result_get_is_authorized (result)) {
+		info->default_private = FALSE;
+	}
+}
+
 static GtkWidget *
 get_config_widgets (const char *bdaddr, const char **uuids)
 {
@@ -1077,6 +1123,19 @@ get_config_widgets (const char *bdaddr, const char **uuids)
 	info->pan = pan;
 	info->dun = dun;
 	
+	/* Check the polkit authorization */
+	info->default_private = TRUE;
+	info->authority = polkit_authority_get_sync (NULL, NULL);
+	info->subject = polkit_unix_process_new (getpid ());
+	polkit_authority_check_authorization (info->authority,
+	                                      info->subject,
+	                                      "org.freedesktop.NetworkManager.settings.modify.system",
+	                                      NULL,
+	                                      POLKIT_CHECK_AUTHORIZATION_FLAGS_NONE,
+	                                      NULL,
+	                                      (GAsyncReadyCallback) check_authorization_cb,
+	                                      info);
+
 	/* BluetoothClient setup */
 	info->btclient = bluetooth_client_new ();
 	info->btmodel = bluetooth_client_get_model (info->btclient);
