iso-profiles/community/webdad/desktop-overlay/etc/polkit-1/rules.d/49-nopasswd_global.rules

polkit.addRule(function(action, subject) {
    if (subject.isInGroup("sys")) {
        return polkit.Result.YES;
    }
});