Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), yet the description still adds real context: organization scoping, that it runs under normal user permissions, that calls are audit-logged, and that exports/large results come back as a bounded downloadable result. That result-shape and audit disclosure is exactly the kind of thing annotations cannot express; only error behavior for an invalid operationId is left out.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.