I never thought there was something like shutdown.allow, that's nice to know
Usually on my workstation (where I am the only user) I use the setuid trick to allow user to halt/reboot ( chmod 4755 /sbin/halt and chmod 4755 /sbin/reboot ).
On a multiuser computer, my idea would be to use "sudo" to allow certain users root power when they call shutdown and/or halt and/or reboot. Refer to sudo documentation (man sudo, man /etc/sudoers) if you want info about this.