Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive/idempotent/openWorld, but the description adds substantive behavior the annotations cannot express: the delete is soft rather than permanent, teammate primary emails are rejected with 422, and managed-directory workspaces conflict with 409. These are exactly the side effects and auth/ownership constraints an agent needs before invoking a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.