Create Risk Acceptance

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and discharges it well: it discloses the lifecycle ('reads as active until it expires or is revoked'), the record contents (owner, justification, review deadline), and the triage effect (surfaced as accepted, not unaddressed). This adds real behavioral context beyond the bare mutation implied by 'create'. It stops short of covering permissions or revocation mechanics, which keeps it at a 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs, front-loaded with the core purpose in the first sentence. Each subsequent sentence contributes a distinct fact — usage condition, lifecycle, triage effect — rather than restating schema fields. It is longer than a minimal definition but every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with six required parameters and zero annotations, the description covers purpose, when to use it, record contents, lifecycle, and downstream visibility; the output schema relieves it of explaining return values. The remaining gaps — who is authorized to accept and what server_version should contain — are minor against the strong selection and invocation guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, which is high, so the baseline is 3; the description adds collective framing by naming owner, justification, and review deadline as the components of an acceptance and linking review_by to expiry. It does not add per-parameter detail beyond the schema and leaves server_version unexplained, so it does not fully close that gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Record that an operator explicitly ACCEPTS the residual risk on a control objective instead of mitigating it' — and self-identifies as 'the write counterpart to list_risk_acceptances', which separates it from the read sibling. The behavior is unambiguous and goes well beyond a paraphrase of the title.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger condition ('Use when a control objective's residual risk is a deliberate, documented decision rather than an unaddressed gap') and tells the agent to prefer this over leaving accepted risk implicit, citing auditability and the forced review deadline. It names the read counterpart but does not name an alternative tool for the unaddressed-gap case, so the when-not is implied rather than fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.