Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a safe, idempotent, read-only operation, so the description carries a lower burden. It adds that only 'authorized' artifacts are returned, which is useful access-control context, but it does not describe not-found/unauthorized behavior or any other operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.