diff --git a/packages/api/src/__tests__/assistant-router.test.ts b/packages/api/src/__tests__/assistant-router.test.ts
index 8623011..3e7c515 100644
--- a/packages/api/src/__tests__/assistant-router.test.ts
+++ b/packages/api/src/__tests__/assistant-router.test.ts
@@ -967,8 +967,8 @@ describe("assistant router tool gating", () => {
     expect(toolDescriptions.get("commit_dispo_import_batch")).toContain("Always confirm first");
     expect(toolDescriptions.get("get_system_settings")).toContain("Admin role");
     expect(toolDescriptions.get("update_system_settings")).toContain("Always confirm first");
-    expect(toolDescriptions.get("get_ai_configured")).toContain("authenticated user");
-    expect(toolDescriptions.get("list_system_role_configs")).toContain("authenticated user");
+    expect(toolDescriptions.get("get_ai_configured")).toContain("Admin role");
+    expect(toolDescriptions.get("list_system_role_configs")).toContain("Admin role");
     expect(toolDescriptions.get("update_system_role_config")).toContain("Admin role");
     expect(toolDescriptions.get("list_webhooks")).toContain("Secrets are masked");
     expect(toolDescriptions.get("create_webhook")).toContain("Always confirm first");
diff --git a/packages/api/src/router/assistant-tools.ts b/packages/api/src/router/assistant-tools.ts
index 51b30dd..4a18e6e 100644
--- a/packages/api/src/router/assistant-tools.ts
+++ b/packages/api/src/router/assistant-tools.ts
@@ -3374,7 +3374,7 @@ export const TOOL_DEFINITIONS: ToolDef[] = [
     type: "function",
     function: {
       name: "get_ai_configured",
-      description: "Get whether AI is configured for the current system via the real settings router. Available to any authenticated user.",
+      description: "Get whether AI is configured for the current system via the real settings router. Admin role required.",
       parameters: {
         type: "object",
         properties: {},
@@ -3385,7 +3385,7 @@ export const TOOL_DEFINITIONS: ToolDef[] = [
     type: "function",
     function: {
       name: "list_system_role_configs",
-      description: "List system role configuration defaults via the real system-role-config router. Available to any authenticated user.",
+      description: "List system role configuration defaults via the real system-role-config router. Admin role required.",
       parameters: {
         type: "object",
         properties: {},