It is possible. As Martti mentions, the only limit is imagination. Here's an example. Business problem to solve: Grant Jay Collaboration Manager on all projects with a Finish Date of 1/1/2014 or later. The following GEL script grants a user collaboration manager on all projects with a Finish Date of 1/1/2014 or later.
You can use this as a soup starter for whatever you need.
<gel:script xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:core="jelly:core" xmlns:gel="jelly:com.niku.union.gel.GELTagLibrary"
xmlns:jxml="jelly:xml" xmlns:soap="jelly:com.niku.union.gel.SOAPTagLibrary" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:sql="jelly:sql" xmlns:util="jelly:util" xmlns:xog="http://www.niku.com/xog" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<gel:parameter default="your_xog_username" var="xogUsername"/>
<gel:parameter default="your_xog_password" secure="true" var="xogPassword"/>
<!-- Get the list of projects where Admin is not Collaboration Manager -->
<gel:setDataSource dbId="niku"/>
<sql:query escapeText="false" var="data">
SELECT
INV.ID INV_ID
, INV.NAME INV_NAME
, INV.CODE INV_CODE
, A.LAST_NAME ADMIN_LAST_NAME
, A.FIRST_NAME ADMIN_FIRST_NAME
, A.EXTERNAL_ID ADMIN_EXTERNAL_ID
, A.UNIQUE_NAME ADMIN_UNIQUE_NAME
, A.EMAIL ADMIN_EMAIL
, ('CLB_PROJECT_MANAGERS'+(CAST(INV.ID AS varchar))) GROUP_ID
, ('project '+(CAST(INV.ID AS varchar)+'CM group')) GROUP_NAME
FROM INV_INVESTMENTS INV
JOIN INV_PROJECTS P ON P.PRID = INV.ID
JOIN SRM_RESOURCES A ON A.USER_ID = 5004239
WHERE INV.SCHEDULE_FINISH > '1/1/2014'
AND INV.ODF_OBJECT_CODE = 'project'
AND P.IS_TEMPLATE = 0
AND A.USER_ID NOT IN
(SELECT USER_ID FROM CMN_SEC_USER_GROUPS WHERE GROUP_ID =
(SELECT ID FROM CMN_SEC_GROUPS G
WHERE G.GROUP_ROLE_TYPE='SEC_GROUP_TYPE'
AND G.PRINCIPAL_TYPE='CLB_PROJECTS'
AND G.GROUP_CODE = 'CLB_PROJECT_MANAGERS'+(CAST(INV.ID AS varchar))
AND G.PRINCIPAL_ID = INV.ID))
</sql:query>
<!-- Get xog URL from application by fpena -->
<core:invokeStatic className="com.niku.union.config.ConfigurationManager" method="getInstance" var="config"/>
<core:set var="v_IsLocal">0</core:set>
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(0).getId()}" var="WebServerid"/>
<core:if test="${WebServerid == 'app'}">
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(0).getAddress()}" var="AddressIp"/>
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(0).getSslEntryUrl()}" var="EntryURL"/>
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(0).getSslPort()}" var="Port"/>
<core:if test="${EntryURL == 'http://localhost' }">
<gel:log level="info" message="NULL ADDRESS IS LOCAL... "/>
<core:set var="v_IsLocal">1</core:set>
<core:set var="AddressIp">${EntryURL}</core:set>
</core:if>
</core:if>
<core:if test="${WebServerid == 'nsa'}">
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(1).getAddress()}" var="AddressIp"/>
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(1).getEntryUrl()}" var="EntryURL"/>
<core:set value="${config.getProperties().getWebServer().getWebServerInstance(1).getPort()}" var="Port"/>
<core:if test="${EntryURL == 'http://localhost' }">
<gel:log level="info" message="NULL ADDRESS IS LOCAL... "/>
<core:set var="v_IsLocal">1</core:set>
<core:set var="AddressIp">${EntryURL}</core:set>
</core:if>
</core:if>
<core:if test="${Port != null }">
<core:set value="${EntryURL}" var="EntryURL"/>
</core:if>
<core:if test="${v_IsLocal == 0 }">
<core:if test="${AddressIp != '' }">
<core:set value="http://${AddressIp}" var="EntryURL"/>
</core:if>
</core:if>
<core:set value="${config.getProperties().getDirectories().getInstallDir()}" var="NIKUHOME"/>
<core:set value="${EntryURL}/niku/xog" var="xogURL"/>
<!-- Log into xog and get a session ID -->
<soap:invoke endpoint="${xogURL}" var="auth">
<soap:message>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xog="http://www.niku.com/xog">
<soapenv:Header/>
<soapenv:Body>
<xog:Login>
<xog:Username>${xogUsername}</xog:Username>
<xog:Password>${xogPassword}</xog:Password>
</xog:Login>
</soapenv:Body>
</soapenv:Envelope>
</soap:message>
</soap:invoke>
<!-- Checking whether a sessionID is returned. If not, it means that login was unsuccessful -->
<gel:set asString="true" select="$auth/SOAP-ENV:Envelope/SOAP-ENV:Body/xog:SessionID/text()" var="sessionID"/>
<core:choose>
<core:when test="${sessionID == null}">
<gel:log>Couldn't log in. Please check the hostname/username/password.</gel:log>
</core:when>
<core:otherwise>
<gel:log>Login successful. Session ID is ${sessionID}</gel:log>
</core:otherwise>
</core:choose>
<core:forEach items="${data.rows}" trim="true" var="row">
<core:set value="${row.get('INV_ID')}" var="inv_id"/>
<core:set value="${row.get('ADMIN_EXTERNAL_ID')}" var="external_id"/>
<core:set value="${row.get('ADMIN_UNIQUE_NAME')}" var="unique_name"/>
<core:set value="${row.get('ADMIN_EMAIL')}" var="email"/>
<core:set value="${row.get('ADMIN_FIRST_NAME')}" var="first_name"/>
<core:set value="${row.get('ADMIN_LAST_NAME')}" var="last_name"/>
<core:set value="${row.get('GROUP_ID')}" var="group_id"/>
<core:set value="${row.get('GROUP_NAME')}" var="group_name"/>
<!-- Xog in collaboration manager permission for project onto Admin -->
<soap:invoke endpoint="${xogURL}" var="runresult">
<soap:message>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xog="http://www.niku.com/xog">
<soapenv:Header>
<xog:Auth>
<xog:SessionID>${sessionID}</xog:SessionID>
</xog:Auth>
</soapenv:Header>
<soapenv:Body>
<NikuDataBus xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../xsd/nikuxog_user.xsd">
<Header action="write" externalSource="NIKU" objectType="user" version="12.1.3.1361"/>
<Users>
<User externalId="" userName="${unique_name}">
<PersonalInformation emailAddress="${email}" firstName="${first_name}" lastName="${last_name}"/>
<Resource resourceId="${unique_name}"/>
<Groups>
<Group id="${group_id}">
<nls languageCode="en" name="${group_name}"/>
</Group>
</Groups>
</User>
</Users>
</NikuDataBus>
</soapenv:Body>
</soapenv:Envelope>
</soap:message>
</soap:invoke>
</core:forEach>
<!-- Log out of xog -->
<soap:invoke endpoint="${xogURL}" var="logoutresult">
<soap:message>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xog="http://www.niku.com/xog">
<soapenv:Header>
<xog:Auth>
<xog:SessionID>${sessionID}</xog:SessionID>
</xog:Auth>
</soapenv:Header>
<soapenv:Body>
<xog:Logout/>
</soapenv:Body>
</soapenv:Envelope>
</soap:message>
</soap:invoke>
<!-- comment out below log output once in production -->
<gel:log> ${xogURL}, ${xogUsername}, ${xogPassword}, ${sessionID}</gel:log>
</gel:script>