A. I would say the scripting language you are most comfortable. And then weight that against what is required to start the apps. Off hand probably combinations of shell,awk,perl.

B. With logic and keeping in mind what these scripts will be doing. I think you can be secure in the process. Tools like ssh,sudo,sudosh with general user / group permissions. But using all these with a clean logic of access and validations.

C. Your choice for the access and control of the scripts. Any user interface can be used to run and execute the scripts as needed. So if you are giving this ability to say your operations support area. Then the access and control could be different than for a group of support UNIX admins.

The how to do it and stay in SOX compliance depends on your environment and what the applications and or instances that you are trying to bounce. If it is a DB environment that would be different and have other support groups and controls that need to be considered like a oracle grid stop / start sql script. Or a web server would maybe need a maintenance page put in place before the service is stopped. Can it be done I would say Yes. Can it be secure, again I would say yes. Has this been done to meet all the security requirements? That would be a yes also.

You don't have to pay for a 3rd party app to do this and then have all the money paid out for support and maintenance. nagios/bigbro/hobbit freeware system monitors / alerting are a start and can send alerts out about problems. But I don't think I would use it to perform the actual bounce of services and applications. But the alert could be sent to a operations support and then they have a procedure that they follow per the alert.

Many services have a auto restart built into them. And the system could do a restart from inittab for services also. That way if a service stops on the server then the OS sees and performs the restart local to the server. No login required and no outside resources needed. You can build smart scripts that the init service would use to bounce a service or application. These methods have been around for years. And if you test and build a script to perform the actions it should not be a problem. Many of the Linux servers have these scripts in the init.d directory. And they are called and used during server stop / start.

Sounds like a challenge and will keep you busy for a month or so. Maybe longer lol...