map_control_to_requirement

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the mutating nature ('Mutating: records a...') and the side effect ('re-derives that requirement's coverage in the compliance report'). It does not mention permissions or reversibility, but it covers the key behavioral trait for a mapping action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences. First sentence states the purpose and effect, second gives usage guidance, third lists alternatives. No fluff, well-structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple mapping tool with 7 params and an output schema, the description covers the primary use case, side effects, and distinguishes from related tools. Since output schema is present, return values need no explanation. The description is complete for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, so the baseline is 3. The description does not add param-specific semantics beyond schema, but it gives context about the mapping's effect and manual intent, which indirectly supports the 'notes' and 'confidence' params without overriding them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('map one security control to one compliance-framework requirement') and the resource ('control-to-requirement mapping'), and distinguishes from sibling tools by naming auto_map_controls and auto_remediate_compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: 'for a single, deliberate mapping you are asserting by hand', and provides alternatives: 'to let the LLM propose mappings across many requirements at once, use auto_map_controls; to close gaps end-to-end (map + exclude + fill), use auto_remediate_compliance.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.