Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructive/readOnly/idempotent annotations: all-or-nothing transaction on a foreign rule (404), one audit row per changed rule, changed:false for already-retired rules, no un-retire path, and running iterations keep their original prompt. This is exactly the behavioral context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.