Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description usefully discloses the 100-operation cap and the hard guarantee that the batch is never executed, which is the key safety trait. However, it says nothing about whether plans expire, whether a plan must be confirmed/reconciled by another tool, or what happens to a rejected operation, so the behavioral burden is only partly carried.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.