The app needs to run a binary (service) with root permission and avoid asking privilege at each start but only at install.
To do so, at first start the app will set-up the service on launchd.
The problem is how to remove that service when the app bundle is deleted ?
Can the launchd service self delete if it detects the app is removed?
EDIT:
The app bundle can be removed even if the service is running and its binary being within the bundle. So far the implementation is that the service will periodically check for the existence of its own path and in case it is no longer valide, it removes itself from launchctl