How it works in AgenID
The first 10 characters encode the timestamp and the last 16 the randomness. Crockford base32 omits I, L, O and U, which avoids look-alike characters and makes every character path-safe. That is why a key can be fetched at https://www.agenid.com/v1/keys/<key-ulid> with no escaping. The registry still checks uniqueness before committing a new identifier rather than relying on collision resistance alone.
Because ULIDs sort by time, a list of identifiers ordered as text is also ordered by creation, which keeps registry indexes and logs readable without a separate timestamp column.
Why it matters
An earlier draft of the specification named keys with a URI fragment, which HTTP never sends to a server, so keys collided. Giving each key its own ULID fixed that. ULIDs are also non-semantic: they carry no operator name or platform, so an AgenID identifier cannot be forged by guessing a meaningful pattern or confused with a platform's own ID.
What it does not mean
A ULID is a name, not a credential. It proves nothing about who created it and grants no permission; what an agent is allowed to do is a separate question the identifier does not answer. Because the leading characters are a timestamp, a ULID also reveals roughly when it was generated, which is public by design in AgenID.