It does appear to exist solely to let users use their own local hardware:

https://wiki.debian.org/PolicyKit

  PolicyKit is an application-level toolkit for defining and handling the policy 
  that allows unprivileged processes to speak to privileged processes, in order to
  grant some user the right to perform some tasks in some situations. It is 
  sometimes referred to as "the sudo of systemd". 

  Sample uses:

    Let the user Hibernate and shutdown the computer.
    Let the user manage (Wireless) connections.
    Let the user mount/eject a removable media (CD/DVD, USB keys...)
    Let the user access devices, like audio, scanner, etc.

We already had a solution for this before: you add the user to the 'audio' group. And SELinux could do this too. But apparently RedHat just wanted another layer (https://lwn.net/Articles/258592/).

"This is better than groups and setgid processes, because it means someone can't log in over ssh and mess with another user at the console." - Because that's what desktop users are really concerned about. We need more complexity because somebody might hax0r my desktop over SSH.

And, wow, they really actually did use XML as their configuration:

    <match action="org.freedesktop.hal.storage.mount-fixed">
      <match user="davidz">
        <return result="yes"/>
      </match>
      <match user="freddy">
        <return result="no"/>
      </match>
    </match>

So, not only is it superfluous, it also doesn't make the user's life easier, it's super annoying to configure, everything depends on it, and now the thing intended to improve security has caused a security issue.