Observability: knowing your application is broken before residents tell you
Logs, metrics, and traces are not a luxury for public-facing systems. They are how you keep a promise.
Blog
Notes from the HQT team on the technology we build for public agencies: AI, cloud, security, data, and software.
Retrieval quality, not the model, decides whether an AI assistant is useful
Chunking, metadata, permission filtering, and evaluation decide whether an agency assistant is useful, and the model is the replaceable part.
Small open models are good enough for many agency tasks
The largest model is not always the right one. For classification, extraction, and grounded answering, smaller models running in the agency's own environment often do the job.
Designing agency software for the counter and the phone at the same time
Staff at a counter and residents on a phone need different things from the same system. Both can be served well.
Five terms we think every agency AI contract should include
Short, specific contract language that protects agencies buying AI-enabled software.
A plain-language glossary of the technology terms in your next IT solicitation
Short definitions for procurement and program staff who have to evaluate technical proposals.
Prompt injection is the new SQL injection, and we test for it
Any system that lets a language model read untrusted text has a new class of vulnerability. Here is how we test before launch.
An acceptable use policy for generative AI should govern data, not tools
What a generative AI acceptable use policy must cover, what it should leave alone, and how to keep it from going stale.
Patching is boring, and that is the point
A repeatable patch process beats any security product an agency could buy.
Your vendor's new AI feature is a new system, not an update
Vendors are adding AI to platforms agencies already license. Here is what to test first, and what to leave switched off.
Every model we deploy for an agency ships with a model card
A short, plain-language document that explains what a model does, how it was tested, and where it should not be used.
Notes on rolling out passkeys to a workforce
Phishing-resistant sign-in is finally practical for ordinary staff. What goes smoothly, and what needs planning.
How we treat AI-generated code in delivery pipelines
Coding assistants are part of how software is written now. Here is what that changes about review and testing, and what it does not.
Open data as a public records strategy
Publishing what people repeatedly ask for is cheaper than answering each request by hand.
Address data is the hardest data a local government owns
Addresses disagree across permitting, assessment, billing, and dispatch, and reconciling them takes an address layer with a named owner.
Running a ransomware tabletop exercise with city leadership
A two-hour exercise format that gets department heads and elected officials ready for a bad day.
Data conversion is the project, not the last two weeks of it
Legacy data resists conversion in ways a schema mapping never shows, so we plan and validate migration as its own project.
API-first integration for agencies that own a dozen vendor systems
How to connect commercial platforms without building a fragile web of point-to-point links.
Using AI to triage service requests without losing the human
How classification models can route 311-style requests, and the guardrails that keep residents from falling through.
Shared responsibility: what your cloud provider will not do for you
Cloud providers secure the cloud. Agencies secure what they put in it. The line between those matters in an audit.
Boring technology is the right default for systems that must run for a decade
Agency systems outlive the teams that choose them, so we default to components that will still be supportable, staffable, and patchable in ten years.
Stop testing with production data
Copying production databases into test environments is common, risky, and usually unnecessary. Here is the alternative.
Model the cloud bill before you move the workload
A method for building a defensible cloud cost estimate before a migration, and the line items a first model leaves out.
Cloud cost surprises and public budgets do not mix
Why variable cloud bills are a governance problem for agencies, and the controls that keep them predictable.
Running language models inside the agency's cloud boundary
For sensitive data, the model should come to the data. Here is what that looks like in practice.
What we mean when we say DevSecOps
The term is overused. Here is the concrete set of practices behind it on our projects.
Why we write the runbook before we write the feature
We draft the runbook for a new service before building the feature it describes, because the operational story surfaces design problems early.
GIS data quality becomes a life-safety issue under NG911
Next Generation 911 routes calls using GIS. That changes what "good enough" means for address data.
Lessons from building a streaming pipeline for sensor data
Real-time data from meters and sensors looks simple until the sensors misbehave. Design notes for utilities and public works.
Zero Trust without buying a Zero Trust platform
Zero Trust is a set of design choices, most of which agencies can make with tools they already own.
Run the tabletop for an outage, not just a breach
A tabletop built around a failed migration or a vendor outage tests decisions a ransomware scenario never reaches.
What we learned building an assistant that answers questions from a municipal code
A retrieval-augmented assistant over a published city code, built as an internal exercise. The hard parts were not the model.
Low-code or custom code? A decision guide for agencies
When a Power Platform or ServiceNow app is the right call, when it is not, and how to tell in advance.
Why dashboards go unused, and what to do about it
Most dashboards die within months. The fix is less about visualization and more about definitions and ownership.
A SOC 2 report is evidence, not a certificate
SOC 2 reports are long, but the four places that should change an agency procurement decision are short and specific.
We are implementing the NIST Cybersecurity Framework on ourselves first
A note on how HQT is building its own security program before asking agencies to trust us with theirs.
A one-page Zero Trust progress report for a council or board
Governing bodies fund what they can see. A simple format for showing security maturity over time.
CJIS for software teams: what actually changes when you touch criminal justice data
A practical summary of the CJIS Security Policy requirements that affect developers and integrators.
Publish DMARC at reject, then keep the callback rule anyway
SPF, DKIM, and DMARC in plain terms, a sequence for reaching enforcement without breaking mail, and the fraud none of them touch.
Replacing a legacy application without a big-bang cutover
How the strangler pattern lets an agency modernize one function at a time while the old system keeps running.
A digital twin starts with the GIS, not the platform
The most valuable part of a utility digital twin is the part nobody wants to fund: accurate asset data.
The accessibility rule for state and local websites is not a future problem
What the ADA Title II web accessibility rule requires and how to start remediating now.
A project is not finished until the agency can run it without the vendor
The artifacts and demonstrations an agency should require at closeout: code, pipelines, runbooks, credentials, and documentation.
Infrastructure as code is for small teams too
The case for scripting your cloud environment even when there are only two of you.
If you only do one security project this year, make it multi-factor authentication
Why MFA everywhere is the highest-value control for a small agency, and how to roll it out without a revolt.
Why we would build a permit portal on serverless services
Resident-facing services have spiky demand and small budgets. Pay-per-use architecture fits both.
What a good statement of work looks like for a software project
The sections we insist on before we start a software engagement, and why each one protects the agency as much as us.
Three integration failures that nobody notices until the data is wrong
File transfers, direct database access, and APIs each fail in a way that tells nobody. Here is how to make each failure visible.
Why we started HQT
A short account of who we are, what we are trying to build, and why we chose state and local government.
Acceptance criteria that a tester can execute and a contract can rely on
Why "the system shall work" cannot be enforced, and how to write acceptance criteria that produce a clear pass or fail.
The questions that expose a weak architecture before award
A question set for reviewing a vendor software architecture before award, and the answers that show a design has not been thought through.
How a council member reads your IT budget request
What the line items in an IT budget request mean, the questions a governing body should ask, and what a strong request contains.
The uptime number is the least important part of a service level agreement
An availability target is enforceable only when the contract defines what counts as available, how it is measured, and what a miss costs.
Discovery should be a small fixed-price project, not a free sales exercise
How we structure a two to four week discovery engagement, what it delivers, and why a fixed price keeps the findings honest.
What a screen reader finds that an accessibility scanner does not
A practical walkthrough of testing an agency site with a screen reader: what to check, what breaks most often, and how to order the fixes.
Design audit logs around the questions you will be asked
Audit logging works best designed backward from the few questions auditors ask, with retention set by policy rather than by tool defaults.