Authentication agents are provided by desktop environments. When an user session starts, the agent registers with the PolicyKit Authority using the RegisterAuthenticationAgent() method. When services are needed, the authority will invoke methods on the org.freedesktop.PolicyKit1.AuthenticationAgent D-Bus interface. Once the user is authenticated, (a privileged part of) the agent invokes the AuthenticationAgentResponse() method. Note that the PolicyKit Authority itself does not care how the agent authenticates the user.

The libpolkit-agent-1 library provides helpers to make it easy to build authentication agents that use the native authentication system e.g. pam(8).