Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so thoroughly: read-only, writes/signs/executes nothing, tenant sourced from configuration rather than an argument, and explicit OK/REFUSED/UNAVAILABLE outcome semantics with a no-fabricated-data guarantee. It also flags the version precondition that yields UNAVAILABLE and the caveat that a readout is not a compliance finding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.