Here is a polkit rule, derived from This huge polkit rule granting wheel all needed rights

All it does it allow all users, not only local, not only active, no group restrictions, to do upgrades. Nothing more, just upgrade.

I think this is totally necessary. There should be no dangers, no "grandma laptops" that would lose configurations, overlays, custom setups etc.

This should also resolve the bug with the rpm-ostreed-automatic.service requiring a polkit password upon GUI login with a non-wheel user, which should be a main target for rpm-ostree distros. Currently, you have to click the update "away" and nonwheels have outdated systems.

Should this be requested upstream?

polkit.addRule(function(action, subject) {
    if (action.id == "org.projectatomic.rpmostree1.upgrade" ||
        action.id == "org.projectatomic.rpmostree1.deploy") {
            return polkit.Result.YES;
    }
});

edit: I guess "deploy" also needs to be granted.