Secure Customer Service Ticketing System with Role-Based Access Control

Customer service in telematics small-to-medium-sized enterprises has critical operational inefficiencies, such as the multi-channel data divide, informal multi-level escalation, and unfair performance accountability. Commercial SaaS offerings have limited success in addressing these issues due to data sovereignty risks and the inability to provide the required level of customization in automated workflows in a sensitive data environment. To resolve these challenges, this paper presents the design, implementation, and empirical evaluation of a custom on-premise Role-Based Access Control (RBAC) ticketing system developed for an Indonesian telematics provider, PT XYZ. Guided by the Design Science Research (DSR) framework, the system introduces three core architectural contributions: (1) a 15-control defense-in-depth security model enforcing triple-layer RBAC across edge-middleware, API-handlers, and client hydration with mandatory TOTP-2FA; (2) a structured state machine with mandatory written-reason gates at inter-departmental handoffs to eliminate undocumented escalations; and (3) an SLA-aware KPI scoring engine incorporating clock-pausing semantics during external delay states. Additionally, a lightweight bilingual (EN/ID) keyword analytics engine provides complaint pattern intelligence under data scarcity. Functional evaluation across 37 test cases — including adversarial SQL injection, XSS, and race conditions — achieved a 100% pass rate. Subsequent empirical utility assessment with the client’s IT Lead across seven operational scopes produced a 5/5 approval rating. These findings demonstrate that custom on-premise architectures with mandatory accountability gates can effectively satisfy data sovereignty, enforce accountability, and ensure fair performance measurement in privacy-sensitive SME environments. Keywords–role-based access control, helpdesk ticketing system, SLA management, KPI scoring engine, defense-in-depth security, telematics customer support, accountability state machine, Next.js, Design Science Research