I have spent 4 hours having to google through whispers and rumour, until I managed to fix this issue. Considering the ambitions the linux fraternity hold out for Ubuntu, and linux in general, I cannot believe the documentation and support is so amateurish. I guess you get what you pay for.
I have solved this problem. Probably not "correctly", but after a wasted day, believe me, it's enough.
First things first. Documentation for polkit-1 is pretty sparse. Even worse, it's probably NOT polkit-1's documentation you need anyway. It's whoever supplied the program you are working with.
In my case, it's NetworkManager. After much trawling, I discovered that polkit-1 reads from /usr/share/polkit-1/actions/
in that dir, are XML files, which correspond to the program which is locked down. In my case, it was /usr/share/polkit-1/actions/org.freedesktop.network-manager-settings.system.policy
If you open this file, you will see:
the secret is the <allow_inactive> element. Change "no" to "yes" (there are a few instances throughout the file. I changed them all). Logout, login, and presto ! the "Edit" button is now active. Now I imagine using one of the "auth_admin" type values would be a better idea. But since I can't find a definitive explanation of what they do, I am leaving it as that. And if some wiseass dares to reply "It's obvious, dimwit", I'll just question the wisdom of playing around with such a sensitive part of the system on intuition.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
<description>Modify system connections</description>
<message>System policy prevents modification of system settings</message>
I apologise for my tone here. I have worked in IT for 25 years, and never once have spent this long on any issue with the Microsoft products I work with for a living. True they are cranky, and not the best at times, but I have never had them simply remove a tool, and then leave users to their own devices.
The reason I am so worked up about this, is that the machine I am configuring needs to be inaccessible, once configured. So not being able to edit network connections when logged in via NX, would have been a show-stopper.
Oh well, have a good night, folks.