hal version 0.5.9-0.git20070218.fc7 introduces the ACL-setting feature. However, this version doesn't recommend upgrading gdm to a recent-enough version which has proper ConsoleKit support. I spent quite some time banging my head against the wall with this, until I ran ck-list-sessions and realized CK knows nothing about my session. Then I've yum-upgraded gdm and the problem was solved.
Interesting. But as things work now I'm closing the bug.