Though your installer may have run as admin (for a number of reasons, including where the AU is located in the file system, etc.), your AU may not have the permissions to perform the method above. On the other hand, you can have your AU operate where it has appropriate permissions.
If you want every user to be able to automatically update it without adminitrator permissions, I propose:
Reasonable permissions seem 774, where you grant every user the ability to automatically update it (read, write, execute) and others can only read it. Because the user and group have the same permissions, it doesn't mather what user is set. This will most likely be the user that installed the files, which is either as user or an administrator account. As for the group, staff would indeed make sense.
So, to summarize:
drwxrwxr-- 1 root staff 1970 Jan 01 00:00 Audio Unit
If there is no executable code, you could use 764:
drw-rw-r-- 1 root staff 1970 Jan 01 00:00 Audio Unit
Based on my security considerations
I don't see what credible sources are needed for, you either grant users the right to automatically update or you don't, there is no in between. Just think thoroughly about both possibilties, and then you get to the point you think is right. I don't really like the above approach so will outline a more secure approach here. For security considerations, you could only let the administrator update the bundle, here is why:
User messes around with stuff in the folder.
Other user uses or executes it and loses valuable time or his/her files.
The administrator (and/or developer) is to blame.
So, in this case I would suggest 764 instead, summarized:
drwxr-xr-- 1 root staff 1970 Jan 01 00:00 Audio Unit
If there is no executable code, you could use 744:
drw-r--r-- 1 root staff 1970 Jan 01 00:00 Audio Unit