Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only flag this as a non-read-only, non-idempotent, non-destructive write; the description adds the scope of the mutation (this user only, not the workspace), the side effect for task_step (goes to workspace admins only), and a confirmation gate. It also discloses a prompt-injection guard, which no annotation conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.