agentsecure.policy.describe

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden and does most of it: it declares the operation is read-only ('Does not change policy'), enumerates what is returned (network domains/ports, IP restrictions, secret_aliases, project_bindings, usage instructions), explicitly excludes secret values, and warns it does not verify credentials. The only gap is that it never mentions auth/permission requirements for reading policy.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with the purpose and scope, then the return payload, then the negative behaviors, then the sibling routing. Every clause carries unique information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must describe the return shape, and it does so concretely (network allowlist, secret_aliases, project_bindings, usage instructions). Combined with the read-only caveat and exclusion of secret values, an agent has everything needed to call and interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4; the description reinforces this with 'Takes no arguments', confirming no scoping inputs are needed. There is no additional semantics to convey beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource + scope: 'Inspect the current project's network rules and configured secret metadata'. It also fixes the moment of relevance ('before a secret-bearing HTTP request'), which separates it from siblings like agentsecure.http.request or agentsecure.identity at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('before a secret-bearing HTTP request') and names two alternative tools with the exact condition that selects each ('secret.status for one env name', 'get_policy_hint for a Mesh action rather than HTTP destination policy'). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.