run_iam_assessment

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal read-only, open-world, and idempotent behavior. The description supplements this by disclosing the output (main risks and remediation plan), but adds no further behavioral context such as scope, cost, or side effects. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no redundant wording; the key action and outcome are front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only tool, the description states purpose and outputs, but it omits any parameter semantics and does not differentiate from the many sibling assessment tools. These gaps lower completeness below the 'get_calls' standard, though annotations compensate for safety context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter, top_risks, with 0% description coverage, and the description does not mention it at all. The parameter name and default (10) provide limited inference, but the description fails to compensate for the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Executa um IAM Assessment no ambiente') and names its outcome ('retorna riscos principais e plano de remediação'), so an agent can identify what the tool does. However, it does not explicitly distinguish this from sibling tools like run_agent_assessment or run_enterprise_identity_audit, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a use case: when an IAM assessment of the environment is needed. But it provides no explicit when-to-use guidance and names no alternative tools, which is a notable gap given the large sibling set with overlapping assessment/audit names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.