Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses that set_tables replaces the allowlist, remove_allowlist disables it, and masking is 'a heuristic policy aid (not a compliance guarantee) and one-way per execution.' It also explains enforcement at the AST level across subqueries/CTEs/JOINs, adding meaningful behavioral context that annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, front-loading the tool's core purpose ('Manage HARD SQL guardrails') and then enumerating actions with concise clarifications. It includes important caveats like the enterprise tier and heuristic limitation. While slightly long, every sentence adds value and there is no redundant fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, 4 actions, destructive operations, enterprise tier), the description covers all key aspects: what each action does, how to lock down tables, PII masking defaults, the heuristic/non-compliance warning, and the enterprise requirement. An output schema exists, so return values need not be described. The description is sufficient for correct tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage of parameter descriptions, including 'Empty array = lock down' and the default behavior for mask_patterns. The description adds some extra context (e.g., 'across subqueries/CTEs/JOINs') but does not significantly redefine or clarify parameters beyond the schema. Baseline 3 is appropriate given the rich schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool's purpose: managing SQL guardrails (table allowlist and PII masking). It specifies the concrete actions (view, set_tables, remove_allowlist, set_pii_policy) and distinguishes it from sibling tools like query_firewall and pii_scan by focusing on the allowlist/PII configuration for an enterprise connection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use each action (e.g., 'set_tables replaces the allowlist (use [] to lock down everything)'), and notes both policies 'opt-out by default.' It does not explicitly name alternative sibling tools, but the action-by-action guidance is sufficient for an agent to know when to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.