Get user assignments

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full behavioral burden. It does disclose useful result semantics (each entry flagged direct or inherited, with requester/approver provenance) and two operational conventions: untrusted quoted text must be treated as data, and people/roles/requests should be referenced by display name rather than OID. It does not cover error behavior for an unknown or unauthorized OID, nor result size or cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is correctly front-loaded in the first clause, but the remainder is two long generic paragraphs (injection handling and display-name style) that are largely tool-agnostic boilerplate and are buried inside the opening sentence's parentheticals. The structure is awkward: safety guidance trails off mid-sentence after an em dash rather than being separated or shortened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema, the description need not explain return shape, and it still adds the direct/inherited flag and provenance semantics an agent would otherwise have to infer from the payload. What is missing is minor: behavior on invalid OIDs and whether results are bounded or paginated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter exists and schema description coverage is 100%, so the baseline is 3. The description adds no meaning to 'oid' itself; the display-name-versus-OID sentence concerns how to present output when writing to a person, not how to supply the parameter, so it does not compensate further.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ('List') with a precisely scoped resource: a user's direct assignments plus effective role membership, annotated as direct vs inherited, together with provenance (who requested and approved). That is well beyond restating the name. It does not explicitly distinguish itself from near-siblings such as get_my_access or list_expiring_access, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus alternatives — notably get_my_access (own access) or list_expiring_access — and no mention of prerequisites such as needing permission to inspect another user's assignments. Usage is only implied by the phrase 'a user's ... assignments'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.