Here's an odd one:
From a console (logged in as an ordinary user), I can pm-suspend and pm-hibernate fine.
However, trying to suspend or hibernate from the Xfce panel action buttons informs me:
Shutdown Failed
Failed to suspend session
not authorized
So it appears as though suspending / hibernating via xfce is subject to a different set of authentication policies to doing it via a console... so where are the policies likely to be stored? (I assume as with most bits of Linux configuration it's a text file somewhere with a fairly self-explanatory set of options...)