The pklocalauthority manpage describes the Result* keys as follows:
ResultActive
The result to return for subjects in an active local session that
matches one or more of the given identities. Allowed values are
similar to what can be used in the defaults section of .policy
files used to define actions, e.g. yes, no, auth_self,
auth_self_keep, auth_admin and auth_admin_keep.
ResultInactive
Like ResultActive but instead applies to subjects in inactive local
sessions.
ResultAny
Like ResultActive but instead applies to any subject.
I interpreted this to mean that ResultAny supersedes the others, since
it "applies to any subject". However, after much configuration
difficulty, a look at the policykit-1 source showed that ResultAny
only applies if not local.
I think it makes the most sense for policykit-1 to let ResultAny really
mean "any": local or non-local. It doesn't make sense to allow a
certain action only if *not* at the console.
(Similarly, it would probably make sense to have ResultInactive apply to
any local session, since it doesn't make sense to allow a certain action
only if *not* active.)
However, if this will not change, then the manpage needs improvement to
make it clear that "ResultAny" applies only if not local.
- Josh Triplett