build_iso_23894

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since there are no annotations, the description carries the full behavioral burden. It is highly transparent by explaining that it uses a 5x5 likelihood x impact matrix and attenuates risk based on evidence count, disclosing the exact computational logic involved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is extremely concise, packing the required inputs, the core calculation method, and the final output format into a single, highly effective paragraph. Every word contributes necessary value to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of generating an AI risk-management report, the description provides a complete picture. It identifies the inputs, the proprietary risk calculation methodology, and the final delivery format (Markdown), leaving no functional gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even with 100% schema coverage, the description adds critical semantic meaning. It explains how the `receipt` input is used to modify the risk calculation (attenuated by receipt evidence count), connecting the variables in a functional way that the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: building an ISO/IEC 23894:2023 AI risk-management report. The tool name itself, coupled with the list of sibling tools (e.g., build_iso_42001), ensures perfect differentiation between compliance standards.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

While it does not explicitly use 'when to use,' the description explains that the tool processes operator-declared scenarios and VAOS receipts. This sets a very clear context for its required inputs, suggesting use in comprehensive risk assessment workflows.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.