It is another piece of RedHat BS that does little to justify its complexity.

The polkit authority is implemented as an system daemon, polkitd(8), which itself has little privilege as it is running as the polkitd system user. Mechanisms, subjects and authentication agents communicate with the authority using the system message bus.

Translation: We will shove the D-Bus the SystemD down your throat.

A mechanism need to declare a set of actions in order to use polkit. Actions correspond to operations that clients can request the mechanism to carry out and are defined in XML files that the mechanism installs into the /usr/share/polkit-1/actions directory.
Both directories are monitored so if a rules file is changed, added or removed, existing rules are purged and all files are read and processed again. Rules files are written in the JavaScript programming language and interface with polkitd through the global polkit object (of type Polkit).

If it uses XML and (gasp) Javascript for configuration, you know it is seriously fscked up.