Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden, and it does establish the essentials: GET implies a non-destructive read, and 'Explicit company required' flags a mandatory scoping/authorization input. It stops short of anything about error behavior (unknown purchaseId), missing-record handling, or whether the query parameter alters the read scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.