Thanks for the reply --

Our product is a Parental Controls product. The kernel module is responsible for traffic capture that, if it's interesting is then proxied to/from the user space (running as root on *nix, system on Windows, etc.) daemon. The daemon in turn occasionally needs to display UI to users. A user may be in any graphical session on the box (e.g. Windows or OS X Fast User Switching, Screen Sharing, ...). The UI itself is more than just notifications. We allow decisions to be made by the user, prompt to login to our product in some situations, etc.

The "backup plan" on OS X is to use the /Library/LaunchAgents plist system so start agents at user login. This works for most of the cases, but there are times such as in our update process that we need to stop all agents -> update them -> restart them.

Hope that helps clarify,

Bryan