get_user_effective_azure_access

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, and non-destructive, so the safety profile is covered. The description adds the meaningful behavioral fact that inheritance traverses transitive groups (not just direct assignments), which is beyond the annotations, but says nothing about pagination, result size, or how the tenant is scoped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is front-loaded with the verb and resource and has no filler. It is efficient, though its brevity means it also omits useful detail rather than being an example of economy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nontrivial 'effective access' computation with no output schema, the description lets an agent know what is computed but not what comes back or how to page results. It is adequate to identify the tool but incomplete for calling it confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the param burden. It only implies a user argument ('de um usuário') via 'user_identifier' but never states the accepted formats (UPN vs object ID) and completely ignores the limit parameter, leaving both undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

It states a specific verb (resolve) and a precise resource (effective Azure RBAC access), and even scopes it to direct plus transitive-group-inherited access. It does not name or differentiate itself from siblings like list_users_with_direct_permissions or list_azure_role_assignments, so an agent must infer when this 'effective' view is preferred.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance despite many closely related siblings (list_azure_role_assignments, list_users_with_direct_permissions, compute_identity_blast_radius). The description never says when resolving effective access beats listing raw assignments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.