Also, in the XML I had the open node of allowedMulty but a close node of allowOverride, which clearly won't work.
Then it turns out, I copied createRole, and left behind the provisioningRequestDef line, which is actually replaced with grantRequestDef and revokeRequestDef. That breaks it with an IO error on the UA side. Very uninformative error.
Geez, you would think I never actually tried this script in real life. Sshh! Don't tell anyone!