# /etc/polkit-1/rules.d/foo.rules

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.power-off" &&
        subject.isInGroup("users")) {
            return polkit.Result.YES;
    }
});