Just used Discover to install a package and as soon as I click the install button, next to the name of the package, the installation starts already. I was not asked for a password. I then uninstalled the same package and now I was asked for a password. I closed Discover, started it again and did the same things again, and again I could install without giving my password. Plasma 5.13, Qt 5.11, Frameworks 5.47, Discover 5.13
Those are the default packagekit permissions: all users can install, only root can uninstall