This feature is from PackageKit-command-not-found.
The authentication is done using polkit (the same mechanism that allows you to use flatpak to install system-wide apps without sudo).
You should be able to find the policy for pk-command-not-found in the files from PackageKit:
$ rpm -ql PackageKit | grep polkit
/usr/share/polkit-1/actions/org.freedesktop.packagekit.policy
/usr/share/polkit-1/rules.d/org.freedesktop.packagekit.rules
(I don’t have it installed so can’t tell you exactly)