I'm currently using the Flatpak ProtonVPN client, and every time I try to connect to or disconnect from one of the over 10,000 servers, there's an authentication prompt asking for the root password. The message is: “System policy prevents modification of network settings for all users”.

Polkit is a bit mind-bending, but after chasing many an out-of-date wild goose down a maze of distro rabbit holes I found a fairly simple solution on the Arch Wiki.

Add to the wheel group any users who should be allowed to make changes to network manager, then create a polkit rules file called
"10-org.freedesktop.NetworkManager.rules" in
/etc/polkit-1/rules.d/ and add the following:

    
/* Allow users in wheel group to modify NetworkManager without authentication */
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
        subject.isInGroup("wheel")) {
        return polkit.Result.YES;
    }
});


  

Reboot for the new rules to become effective and you should be done.

I'll leave this here for anyone searching for the same symptoms. Leave a comment if you have a better method to get polkit to shut up.

Edit: You don't have to use the wheel group, it can be any group that your vpn-using user is in. I had already added myself to the wheel group so I used that.