ostree-native-containers/etc/polkit-1/rules.d/80-systemd-unit-manage.rules

polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.systemd1.manage-units" && subject.local && subject.active && subject.isInGroup("wheel")) {
      return polkit.Result.YES;
  }
});