OS X - Truly 'On Demand' Privileged Helper Tool

Question

My application needs to write files to restricted places on the filesystem.
To do so, I use a helper tool that is run as root.

Everything is working correctly, fol

Answer 1

Typing man launchd.plist into Terminal gives you all the options that launchd understands. Among those you can find (emphasis mine):

KeepAlive < boolean or dictionary of stuff >

This optional key is used to control whether your job is to be kept continuously running or to let demand and conditions control the invocation. The default is false and therefore only demand will start the job. The value may be set to true to unconditionally keep the job alive. Alternatively, a dictionary of conditions may be specified to selectively control whether launchd keeps a job alive or not. If multiple keys are provided, launchd ORs them, thus providing maximum flexibility to the job to refine the logic and stall if necessary. If launchd finds no reason to restart the job, it falls back on demand based invocation. Jobs that exit quickly and frequently when configured to be kept alive will be throttled to conserve system resources.

You don't write what your "various combinations of keys and values" were exactly. But from this documentation, if you want a daemon that gets launched on demand, you should simply drop the <key>KeepAlive</key> from your plist or have its value set to <false/> instead of a <dict>...</dict>.