Stewart, I'm having troubles understanding the author's reply to the SGID suggestion. What I was proposing was to set things up with a command like this (executed just once):
BINARY=/path/to/binary ; sudo chmod 02711 $BINARY ; sudo chown root:disk $BINARY
...Which would mean that the user would have their effective group ID changed to 'disk' only while the binary was running. This means that, during program execution, it would be have the same level of access as if the user belonged to the 'disk' group; however, this would drop back to their previous group membership when the binary exited. As a bonus, you don't have to change the system group memberships. (The program in question should, of course, guard against writing to the wrong device while it's running, and prevent shell-outs).
-Chris