Definitive Rules for Using Secure Enclave on MacOS

Can someone tell me the applications requirements for using the secure enclave on MacOS? Does the application need to be signed with the secure-enclave entitlement in order to use it? Since this is a restricted entitlement, does my App ID need approval to use it from Apple? Currently I'm building in XCode 16 on Sequoia (15.5) using developer signing. My application is a C/C++ daemon running as plist out of /Library/LaunchDaemons. I have also built it as an application using the instructions here but this has not lead to a solution:

https://developer.apple.com/documentation/xcode/signing-a-daemon-with-a-restricted-entitlement/

When I run my application from the command line via sudo signed but without the secure-enclave entitlement enabled in my entitlements file it runs. The first call to:

SecAccessControlRef access = SecAccessControlCreateWithFlags( kCFAllocatorDefault, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, kSecAccessControlPrivateKeyUsage, &error);

succeeds without error. The call to create the key using:

SecKeyRef privateKey = SecKeyCreateRandomKey(attributes, &error);

then fails with error: (OSStatus error -50 - Failed to generate keypair)

Here are the setup attributes (keySize = 256):

	CFDictionarySetValue(attributes, kSecAttrKeyType, kSecAttrKeyTypeECSECPrimeRandom);
	CFDictionarySetValue(attributes, kSecAttrKeySizeInBits, keySize);
	CFDictionarySetValue(attributes, kSecAttrLabel, keyName);
	CFDictionarySetValue(attributes, kSecAttrApplicationTag, keyLabel);
	CFDictionarySetValue(attributes, kSecAttrTokenID, kSecAttrTokenIDSecureEnclave);	// Store in the Secure Enclave
	CFDictionarySetValue(attributes, kSecAttrKeyClass, kSecAttrKeyClassPrivate);
	CFDictionarySetValue(attributes, kSecAttrAccessControl, access);
	CFDictionarySetValue(attributes, kSecAttrIsPermanent, kCFBooleanTrue);		// persist key across app restarts and reboots
	CFDictionarySetValue(attributes, kSecAttrCanEncrypt, kCFBooleanTrue);
	CFDictionarySetValue(attributes, kSecAttrCanDecrypt, kCFBooleanTrue);	
	CFDictionarySetValue(attributes, kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly);
	CFDictionarySetValue(attributes, kSecReturnPersistentRef, kCFBooleanTrue);

When I run the application signed and include the "com.apple.developer.secure-enclave" in my entitlements file it crashes at startup. I believe this is to be expected based on above. How do I proceed such that my application can use the secure enclave correctly?