insert() doesn't work in workflow if there is a timer activity before the script activity in New York.
In the below workflow, query a non-admin user and try to add the "admin" role to the user in the "script" activity using "gr.insert()" on "sys_user_grmember" table.
It will fail to add an admin role since the "timer" activity changed "run by" from Login-use to SYSTEM.
This was working fine on London.
Admin now contains protected role "sn_templated_snip.template_snippet_admin" and thus timer run by a SYSTEM and then try to add role which assigns role such as admin (inherited) that contain protected role, then add fail.
Possible workaround is to impersonate to another admin user before "insert()".
var myUser = gs.getSession().impersonate('user_sys_id');