[This is actually F13's NetworkManager 0.8.1-0.1.git20100510, but upstream git doesn't look like anything's changed.]

IMO NetworkManager should use policykit for all setting changes.  Here are two problems with the current state of affairs:

1. Set up a machine running nm.  ssh in as a random user (who isn't logged in locally) and type 'nmcli nm sleep.'  Don't try this on a machine you're not sitting in front of.

2. Set up a multiuser machine that users are expected to log into locally but where you don't want them messing up ssh users.  Become annoyed when you can't figure out how to make policykit do that.

(Of course, you can use whatever setting plugin you have to prevent NM from managing your connections, but then firefox always thinks you're offline, which is a whole different bug (if you even think it's a bug).)