Implementation of Role-Based Access Control in the Design and Development of the Surabaya City Police (Polrestabes Surabaya) Website

Abstract

The digitalization of public services requires structured complaint processing and controlled access to sensitive internal functions. This study develops and evaluates a web-based information and public complaint system for Surabaya Metropolitan Police using Rapid Application Development (RAD), Laravel, and MySQL. Role-Based Access Control (RBAC) separates Administrator, Sub-administrator, and Officer functions, while assignment checks constrain Officers to their own cases. IP allowlisting and operating-hour restrictions were implemented as additional controls, and VPN access was tested through approved exit IPs. Evaluation used fictitious complaint data, nine functional black-box tests, 12 authorization scenarios, and 14 IP, time, and VPN scenarios; all returned their expected outcomes. In a controlled comparison of 37 internal role-route combinations, all 37 were accessible with RBAC disabled, whereas with RBAC enabled 19 were permitted and 18 denied according to policy. Usability evaluation with 50 participants yielded a mean System Usability Scale (SUS) score of 82.70. The results support successful implementation of the tested functions and role-based restrictions, but do not establish general resistance to cyberattacks or operational effectiveness in a production deployment.