Allow users to update certain applications
We do this by using a management framework that basically has a sudo functionality that's controlled and logged centrally. If you don't want to create your own management framework, look for something like JAMF Software's Casper suite or an open-source framework like munki to manage patches and application installs. I don't know if munki handles the admin/standard user issue, but it's a place to start if you have no budget but can spend time learning if a tool might help you.


http://www.jamfsoftware.com/products/casper-suite/macosx/patch-management/


The Casper self-service portal idea allows normal users to pick from items that you have allowed self-updating and self-patching without needing any user on the receiving end of the patch/update to be an admin user.