Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say it is a non-read-only, non-destructive, closed-world call. The description adds real behavior beyond that: no grant exists until the provider explicitly approves, and the reason field is stored as metadata so credentials or request/response content must not be included. Only the response shape and what happens after approval are left unstated, which the output schema covers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.