Thanks for the suggestions.
Script appears to be running as admin based on logs. The :log trick is handy but doesn't seem to be giving me much more information than I can already infer based on what changes and what doesn't before/after script run. I notice in the wiki there is this:
:do {
:put [:resolve www.example.com];
} on-error={ :put "resolver failed"};
:put "lala"
Any way to capture the error and log that rather than just a string?