Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the baseline is low, but the description adds real behavior: the returned stage, per-candidate is_proven and has_reply_fetch flags, a job-level needs_session_bootstrap, the guarantee that no credential value is ever returned, and the required read scope. These go beyond annotations and beyond what an agent could infer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.