audit_lambda_resource_policies

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and non-destructive annotations, the description details scanning scope, region defaulting to AWS_REGION or us-east-1, severity classification logic for wildcard and service principals, and the exact conditions under which findings are produced. This is far more than the annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is thorough yet economical. It front-loads the purpose, then provides scanning behavior, severity rules, and output format. No sentence is wasted, and the structure flows logically from purpose to invocation details to return value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully explains the return shape: a dict with check, ok, findings, and scanned keys, including details about finding normalization. The single optional parameter is also clarified. The tool is complex, but nothing necessary for correct invocation and interpretation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines an optional region parameter with zero description coverage. The tool description compensates by explaining that the region argument defaults to AWS_REGION or us-east-1 when omitted, giving the agent the exact behavior needed to invoke it correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb and resource: 'Audit Lambda function resource policies for overly broad invoke access.' It clearly distinguishes this tool from its audit siblings by targeting Lambda resource policies and defining the exact scope of what is inspected.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the audit context clear and explains the scanning behavior, but it does not explicitly state when to prefer this tool over alternatives such as audit_full_posture or audit_world_open_security_groups. Usage is implied rather than directly contrasted with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.