rpm-ostree install with the official fedora repo?
rpm-ostree installOperations such as changing kernel arguments, installing a local package, rebasing to another image, etc. will thus be removed from the current Polkit rule and will now require the administrator password, similarly to calling it via sudo.