Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive=true, idempotent=true, openWorld=false, readOnly=false, so the safety profile is carried by structured data. The description adds that the effect is queued (not immediate) and gated on an approval reference, which is genuine extra context, but it says nothing about what gets destroyed or whether counts are validated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.