Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only flag destructive=true and idempotent=true; the description adds substantial context beyond that: deletion is reversible via Trash, refusals are reported per-task with reasons, and restoration is restricted to the creator or a workspace admin. That is exactly the behavioral depth an agent needs before a destructive batch call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.