https://hqt.org/blog/Notes from the HQT team on the technology we build for public agencies: AI, cloud, security, data, and software.en-ushttps://hqt.org/blog/observability-for-agency-applications/https://hqt.org/blog/observability-for-agency-applications/Wed, 09 Sep 2026 08:00:00 +0000EngineeringLogs, metrics, and traces are not a luxury for public-facing systems. They are how you keep a promise.https://hqt.org/blog/retrieval-quality-decides-assistant-usefulness/https://hqt.org/blog/retrieval-quality-decides-assistant-usefulness/Wed, 09 Sep 2026 08:00:00 +0000AIChunking, metadata, permission filtering, and evaluation decide whether an agency assistant is useful, and the model is the replaceable part.https://hqt.org/blog/evaluating-small-open-models-for-agency-tasks/https://hqt.org/blog/evaluating-small-open-models-for-agency-tasks/Wed, 02 Sep 2026 08:00:00 +0000AIThe largest model is not always the right one. For classification, extraction, and grounded answering, smaller models running in the agency's own environment often do the job.https://hqt.org/blog/designing-for-the-counter-and-the-phone/https://hqt.org/blog/designing-for-the-counter-and-the-phone/Wed, 26 Aug 2026 08:00:00 +0000EngineeringStaff at a counter and residents on a phone need different things from the same system. Both can be served well.https://hqt.org/blog/what-agencies-should-require-in-an-ai-contract/https://hqt.org/blog/what-agencies-should-require-in-an-ai-contract/Wed, 26 Aug 2026 08:00:00 +0000Public SectorShort, specific contract language that protects agencies buying AI-enabled software.https://hqt.org/blog/a-plain-language-glossary-for-procurement-staff/https://hqt.org/blog/a-plain-language-glossary-for-procurement-staff/Wed, 19 Aug 2026 08:00:00 +0000Public SectorShort definitions for procurement and program staff who have to evaluate technical proposals.https://hqt.org/blog/prompt-injection-is-the-new-sql-injection/https://hqt.org/blog/prompt-injection-is-the-new-sql-injection/Wed, 19 Aug 2026 08:00:00 +0000SecurityAny system that lets a language model read untrusted text has a new class of vulnerability. Here is how we test before launch.https://hqt.org/blog/acceptable-use-policy-for-generative-ai/https://hqt.org/blog/acceptable-use-policy-for-generative-ai/Wed, 19 Aug 2026 08:00:00 +0000AIWhat a generative AI acceptable use policy must cover, what it should leave alone, and how to keep it from going stale.https://hqt.org/blog/patching-is-boring-and-that-is-the-point/https://hqt.org/blog/patching-is-boring-and-that-is-the-point/Wed, 12 Aug 2026 08:00:00 +0000SecurityA repeatable patch process beats any security product an agency could buy.https://hqt.org/blog/vendor-ai-feature-is-a-new-system/https://hqt.org/blog/vendor-ai-feature-is-a-new-system/Wed, 12 Aug 2026 08:00:00 +0000AIVendors are adding AI to platforms agencies already license. Here is what to test first, and what to leave switched off.https://hqt.org/blog/model-cards-for-public-sector-ml/https://hqt.org/blog/model-cards-for-public-sector-ml/Wed, 05 Aug 2026 08:00:00 +0000DataA short, plain-language document that explains what a model does, how it was tested, and where it should not be used.https://hqt.org/blog/passkeys-rollout-notes/https://hqt.org/blog/passkeys-rollout-notes/Wed, 05 Aug 2026 08:00:00 +0000SecurityPhishing-resistant sign-in is finally practical for ordinary staff. What goes smoothly, and what needs planning.https://hqt.org/blog/ai-generated-code-in-our-pipelines/https://hqt.org/blog/ai-generated-code-in-our-pipelines/Wed, 29 Jul 2026 08:00:00 +0000EngineeringCoding assistants are part of how software is written now. Here is what that changes about review and testing, and what it does not.https://hqt.org/blog/open-data-that-reduces-records-requests/https://hqt.org/blog/open-data-that-reduces-records-requests/Wed, 22 Jul 2026 08:00:00 +0000DataPublishing what people repeatedly ask for is cheaper than answering each request by hand.https://hqt.org/blog/address-data-is-the-hardest-data-a-local-government-owns/https://hqt.org/blog/address-data-is-the-hardest-data-a-local-government-owns/Wed, 22 Jul 2026 08:00:00 +0000DataAddresses disagree across permitting, assessment, billing, and dispatch, and reconciling them takes an address layer with a named owner.https://hqt.org/blog/incident-response-tabletop-for-a-city/https://hqt.org/blog/incident-response-tabletop-for-a-city/Wed, 15 Jul 2026 08:00:00 +0000SecurityA two-hour exercise format that gets department heads and elected officials ready for a bad day.https://hqt.org/blog/data-conversion-is-the-project/https://hqt.org/blog/data-conversion-is-the-project/Wed, 15 Jul 2026 08:00:00 +0000DataLegacy data resists conversion in ways a schema mapping never shows, so we plan and validate migration as its own project.https://hqt.org/blog/api-first-integration-in-local-government/https://hqt.org/blog/api-first-integration-in-local-government/Wed, 08 Jul 2026 08:00:00 +0000EngineeringHow to connect commercial platforms without building a fragile web of point-to-point links.https://hqt.org/blog/ai-triage-for-service-requests/https://hqt.org/blog/ai-triage-for-service-requests/Wed, 08 Jul 2026 08:00:00 +0000AIHow classification models can route 311-style requests, and the guardrails that keep residents from falling through.https://hqt.org/blog/reading-a-cloud-shared-responsibility-model/https://hqt.org/blog/reading-a-cloud-shared-responsibility-model/Wed, 01 Jul 2026 08:00:00 +0000CloudCloud providers secure the cloud. Agencies secure what they put in it. The line between those matters in an audit.https://hqt.org/blog/boring-technology-for-decade-long-systems/https://hqt.org/blog/boring-technology-for-decade-long-systems/Wed, 01 Jul 2026 08:00:00 +0000EngineeringAgency systems outlive the teams that choose them, so we default to components that will still be supportable, staffable, and patchable in ten years.https://hqt.org/blog/synthetic-test-data-for-government-systems/https://hqt.org/blog/synthetic-test-data-for-government-systems/Wed, 24 Jun 2026 08:00:00 +0000EngineeringCopying production databases into test environments is common, risky, and usually unnecessary. Here is the alternative.https://hqt.org/blog/model-the-cloud-bill-before-you-migrate/https://hqt.org/blog/model-the-cloud-bill-before-you-migrate/Wed, 24 Jun 2026 08:00:00 +0000CloudA method for building a defensible cloud cost estimate before a migration, and the line items a first model leaves out.https://hqt.org/blog/cloud-cost-surprises-in-public-budgets/https://hqt.org/blog/cloud-cost-surprises-in-public-budgets/Wed, 17 Jun 2026 08:00:00 +0000CloudWhy variable cloud bills are a governance problem for agencies, and the controls that keep them predictable.https://hqt.org/blog/running-language-models-inside-the-agency-boundary/https://hqt.org/blog/running-language-models-inside-the-agency-boundary/Wed, 17 Jun 2026 08:00:00 +0000AIFor sensitive data, the model should come to the data. Here is what that looks like in practice.https://hqt.org/blog/what-we-mean-by-devsecops/https://hqt.org/blog/what-we-mean-by-devsecops/Wed, 10 Jun 2026 08:00:00 +0000EngineeringThe term is overused. Here is the concrete set of practices behind it on our projects.https://hqt.org/blog/why-we-write-runbooks-before-features/https://hqt.org/blog/why-we-write-runbooks-before-features/Wed, 10 Jun 2026 08:00:00 +0000EngineeringWe draft the runbook for a new service before building the feature it describes, because the operational story surfaces design problems early.https://hqt.org/blog/gis-data-quality-and-ng911/https://hqt.org/blog/gis-data-quality-and-ng911/Wed, 03 Jun 2026 08:00:00 +0000Public SectorNext Generation 911 routes calls using GIS. That changes what "good enough" means for address data.https://hqt.org/blog/streaming-sensor-data-lessons/https://hqt.org/blog/streaming-sensor-data-lessons/Wed, 03 Jun 2026 08:00:00 +0000DataReal-time data from meters and sensors looks simple until the sensors misbehave. Design notes for utilities and public works.https://hqt.org/blog/zero-trust-without-buying-a-platform/https://hqt.org/blog/zero-trust-without-buying-a-platform/Wed, 27 May 2026 08:00:00 +0000SecurityZero Trust is a set of design choices, most of which agencies can make with tools they already own.https://hqt.org/blog/tabletop-exercise-for-an-outage-not-just-a-breach/https://hqt.org/blog/tabletop-exercise-for-an-outage-not-just-a-breach/Wed, 27 May 2026 08:00:00 +0000SecurityA tabletop built around a failed migration or a vendor outage tests decisions a ransomware scenario never reaches.https://hqt.org/blog/building-a-code-assistant-over-a-municipal-code/https://hqt.org/blog/building-a-code-assistant-over-a-municipal-code/Wed, 20 May 2026 08:00:00 +0000AIA retrieval-augmented assistant over a published city code, built as an internal exercise. The hard parts were not the model.https://hqt.org/blog/choosing-between-low-code-and-custom/https://hqt.org/blog/choosing-between-low-code-and-custom/Wed, 13 May 2026 08:00:00 +0000EngineeringWhen a Power Platform or ServiceNow app is the right call, when it is not, and how to tell in advance.https://hqt.org/blog/dashboards-that-nobody-uses/https://hqt.org/blog/dashboards-that-nobody-uses/Wed, 06 May 2026 08:00:00 +0000DataMost dashboards die within months. The fix is less about visualization and more about definitions and ownership.https://hqt.org/blog/reading-a-soc-2-report-without-being-an-auditor/https://hqt.org/blog/reading-a-soc-2-report-without-being-an-auditor/Wed, 06 May 2026 08:00:00 +0000SecuritySOC 2 reports are long, but the four places that should change an agency procurement decision are short and specific.https://hqt.org/blog/we-are-implementing-nist-csf-in-our-own-company/https://hqt.org/blog/we-are-implementing-nist-csf-in-our-own-company/Wed, 29 Apr 2026 08:00:00 +0000CompanyA note on how HQT is building its own security program before asking agencies to trust us with theirs.https://hqt.org/blog/zero-trust-progress-report-format/https://hqt.org/blog/zero-trust-progress-report-format/Wed, 29 Apr 2026 08:00:00 +0000SecurityGoverning bodies fund what they can see. A simple format for showing security maturity over time.https://hqt.org/blog/cjis-for-software-teams/https://hqt.org/blog/cjis-for-software-teams/Wed, 22 Apr 2026 08:00:00 +0000SecurityA practical summary of the CJIS Security Policy requirements that affect developers and integrators.https://hqt.org/blog/dmarc-enforcement-and-the-callback-rule/https://hqt.org/blog/dmarc-enforcement-and-the-callback-rule/Wed, 22 Apr 2026 08:00:00 +0000SecuritySPF, DKIM, and DMARC in plain terms, a sequence for reaching enforcement without breaking mail, and the fraud none of them touch.https://hqt.org/blog/strangler-pattern-for-legacy-agency-apps/https://hqt.org/blog/strangler-pattern-for-legacy-agency-apps/Wed, 15 Apr 2026 08:00:00 +0000EngineeringHow the strangler pattern lets an agency modernize one function at a time while the old system keeps running.https://hqt.org/blog/digital-twin-starts-with-data/https://hqt.org/blog/digital-twin-starts-with-data/Wed, 15 Apr 2026 08:00:00 +0000DataThe most valuable part of a utility digital twin is the part nobody wants to fund: accurate asset data.https://hqt.org/blog/accessibility-deadline-for-state-and-local-web/https://hqt.org/blog/accessibility-deadline-for-state-and-local-web/Wed, 08 Apr 2026 08:00:00 +0000Public SectorWhat the ADA Title II web accessibility rule requires and how to start remediating now.https://hqt.org/blog/software-project-handover-checklist/https://hqt.org/blog/software-project-handover-checklist/Wed, 08 Apr 2026 08:00:00 +0000EngineeringThe artifacts and demonstrations an agency should require at closeout: code, pipelines, runbooks, credentials, and documentation.https://hqt.org/blog/infrastructure-as-code-for-small-teams/https://hqt.org/blog/infrastructure-as-code-for-small-teams/Wed, 01 Apr 2026 08:00:00 +0000CloudThe case for scripting your cloud environment even when there are only two of you.https://hqt.org/blog/multi-factor-authentication-is-the-first-project/https://hqt.org/blog/multi-factor-authentication-is-the-first-project/Wed, 25 Mar 2026 08:00:00 +0000SecurityWhy MFA everywhere is the highest-value control for a small agency, and how to roll it out without a revolt.https://hqt.org/blog/serverless-for-a-permit-portal/https://hqt.org/blog/serverless-for-a-permit-portal/Wed, 25 Mar 2026 08:00:00 +0000CloudResident-facing services have spiky demand and small budgets. Pay-per-use architecture fits both.https://hqt.org/blog/what-a-good-statement-of-work-looks-like/https://hqt.org/blog/what-a-good-statement-of-work-looks-like/Wed, 18 Mar 2026 08:00:00 +0000EngineeringThe sections we insist on before we start a software engagement, and why each one protects the agency as much as us.https://hqt.org/blog/three-integration-failures-that-stay-quiet/https://hqt.org/blog/three-integration-failures-that-stay-quiet/Wed, 11 Mar 2026 08:00:00 +0000EngineeringFile transfers, direct database access, and APIs each fail in a way that tells nobody. Here is how to make each failure visible.https://hqt.org/blog/why-we-started-hqt/https://hqt.org/blog/why-we-started-hqt/Mon, 09 Mar 2026 08:00:00 +0000CompanyA short account of who we are, what we are trying to build, and why we chose state and local government.https://hqt.org/blog/acceptance-criteria-that-protect-the-agency/https://hqt.org/blog/acceptance-criteria-that-protect-the-agency/Wed, 04 Mar 2026 08:00:00 +0000EngineeringWhy "the system shall work" cannot be enforced, and how to write acceptance criteria that produce a clear pass or fail.https://hqt.org/blog/questions-that-expose-a-weak-architecture/https://hqt.org/blog/questions-that-expose-a-weak-architecture/Wed, 25 Feb 2026 08:00:00 +0000Public SectorA question set for reviewing a vendor software architecture before award, and the answers that show a design has not been thought through.https://hqt.org/blog/reading-an-it-budget-request-as-a-council-member/https://hqt.org/blog/reading-an-it-budget-request-as-a-council-member/Wed, 18 Feb 2026 08:00:00 +0000Public SectorWhat the line items in an IT budget request mean, the questions a governing body should ask, and what a strong request contains.https://hqt.org/blog/service-levels-that-can-be-enforced/https://hqt.org/blog/service-levels-that-can-be-enforced/Wed, 11 Feb 2026 08:00:00 +0000Public SectorAn availability target is enforceable only when the contract defines what counts as available, how it is measured, and what a miss costs.https://hqt.org/blog/discovery-should-be-a-small-fixed-price-project/https://hqt.org/blog/discovery-should-be-a-small-fixed-price-project/Wed, 28 Jan 2026 08:00:00 +0000CompanyHow we structure a two to four week discovery engagement, what it delivers, and why a fixed price keeps the findings honest.https://hqt.org/blog/what-a-screen-reader-finds-that-a-scanner-does-not/https://hqt.org/blog/what-a-screen-reader-finds-that-a-scanner-does-not/Wed, 21 Jan 2026 08:00:00 +0000EngineeringA practical walkthrough of testing an agency site with a screen reader: what to check, what breaks most often, and how to order the fixes.https://hqt.org/blog/designing-audit-logs-around-auditor-questions/https://hqt.org/blog/designing-audit-logs-around-auditor-questions/Wed, 14 Jan 2026 08:00:00 +0000SecurityAudit logging works best designed backward from the few questions auditors ask, with retention set by policy rather than by tool defaults.