You should not need to use sudo or any root privileges to logout. Even with no policykit. As far as shutdown and poweroff requests, that is usually handled by consolekit.
Consolekit makes use of some rules. The above files make the rules more flexible.
The "sudo" part I mentioned is related to groups to which the priviledge of shutting down without the root password will be given. Therefore to use it you need to check the /etc/group file and the groups the user belong to. Another possibility if I remember would to put "Identity=user:login_name_of_the_user" instead of "Identity=unix-group:something".
Exemples:
http://mdzlog.alcor.net/2010/06/27/navigating-the-policykit-maze/https://wiki.archlinux.org/index.php/PolicyKit#Authoritiesand things are moving, so… ConsoleKit will no more be in use in the distributions. I suggest you try the file I provided, for me it works in any distro, Ubuntu (using Upstart) and in Archlinux (using systemd - and systemctl-logind instead of ConsoleKit).
Edit: and to add this file for a distribution provided for all, the line Identity=unix-group:
something
is the way to go.
For exemple, if the distro has as an habbit to make the first user created belonging to the group "sudo", (as in Ubuntu) then you should use "sudo". If the distro has another habbit, for exemple the first user created (and or others) belong to the group "users", then instead of "sudo" you could use "users". If you want to make your version more restrictive, then you could write Identity=unix-group:wheel, and just tell the users that only if they make their login name belong to the wheel group, they can have the privilege, which will mean that they need to make use of the root password to add the user Bob, Alice or whoever to the wheel group, therefore the shutdown, access to internal or external file systems, CD, whatever, will be entirely under their responsibility (even though you can make it easier for them to manage it).
