List or add policy rules

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and readOnlyHint=false, so the safety profile is covered. The description adds real value beyond that: the required scopes (policies:read for list, policies:write for add) and the fact that add creates a new policy version, which the agent cannot infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four front-loaded sentences: purpose, event_ids usage, WDAC prohibition, auth requirements. Every sentence carries information and the ordering moves from what-it-does to how-to-call-it. Slightly dense but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter dual-mode tool with no output schema, the description covers both actions, the event_ids workflow, the WDAC restriction, and auth scopes. Missing only pagination behavior and return shape, which are minor given no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 70% schema coverage the baseline is 3, but the description adds meaning beyond the schema: it explains how event_ids and status interact ('status=allowed for allow all these audit events'), notes type as an event-derived override, and warns against explicit hash rules. Pagination params (limit/offset) remain unexplained, keeping it below a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs and resource: 'Lists policy rules or creates a new policy version with explicit rules or event-derived rules.' This clearly separates it from list_policies and show_policy (which deal in policies, not rules) and names the two operating modes tied to the action enum.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use for the event_ids+status=allowed path and an explicit prohibition ('Do not add explicit flat file-hash rules for Windows WDAC'), plus per-action auth requirements. It stops short of naming sibling alternatives like manage_policy_intel_sources for hash IOCs, but the context and exclusions are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.