Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It discloses response statuses, that confirmed logins return first name and customer number, that passwords and sessions are never returned, and that polling repeatedly is inappropriate. This is strong behavioral context, though it does not discuss authentication or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.