The city that protects: introducing the Lagoa Municipal Police to ‘City as a Platform’

There comes a point when digital transformation stops being “just another project” and becomes an operating model the foundation that supports day-to-day operations and improves decision-making, response times and accountability. In Lagoa, that level of maturity has already been reached. Its smart city strategy has continuity, maturity and execution capacity, anchored by an Operations Centre that runs continuously and supports the structured collection of data and incidents. (Source: The SmartCity Lagoa Project)

The next step, therefore, is not to “digitise” another service in isolation. It is to integrate it into the platform, strengthening consistency across channels, processes and data and, in doing so, improving operational efficiency, reducing response times and increasing public trust.

This is where the Municipal Police becomes critical.

Why does the Municipal Police need a platform?

The Municipal Police is not a front-desk service, nor does it operate through a linear process. By its very nature, it depends on:

• territory (maps, areas, events, restrictions, hotspots);

• workflows (triage → dispatch → intervention → closure → process);

• evidence (records, attachments, evidence, chain of custody, audit);

• deadlines and formal procedures (official reports, notifications, case handling, decisions);

• interdependencies (mobility/parking, municipal services, archives, security forces, civil protection).

  

In Lagoa, the size of the territory (88.25 km²) and its operational profile, shaped by tourism seasonality, events and pressure on public space, make it even more important to have a single, integrated and governed system, rather than a collection of disconnected “digital islands”.

At the same time, the service has a clear mission that demands rigour: enforcing laws and municipal regulations, as established by Law No. 19/2004, which defines its responsibilities for monitoring compliance with laws and municipal regulations, as well as cooperating with security forces in protecting local communities. (Source: Law No. 19/2004)

In Lagoa specifically, these responsibilities and the organisation of the service are set out in Regulation No. 1212/2023 – Regulation of the Lagoa Municipal Police, which establishes its operational framework and areas of activity. (Source: Diário da República)

It is also important to underline that the Municipal Police operates in coordination with the security forces with territorial responsibility, the PSP or GNR, as provided for under Law No. 19/2004, ensuring complementary roles and respect for the chain of responsibility in public security.

In practice, all of this is a platform by definition. Because what is needed is not “another app”, but a coherent set of shared capabilities such as identity, maps, workflow, notifications, evidence, archives and indicators that support operations while ensuring traceability, security and accountability.

A platform is not an APP!

“Building an APP for the Police” is tempting. It seems fast, visible and easy to justify. But, in most cases, it is a strategic mistake, because it creates yet another isolated solution and increases the fragmentation of data, processes and responsibilities.

A City as a Platform approach starts from a simple principle: you do not build islands, you build shared capabilities. The municipality creates (or reuses) cross-cutting building blocks and, on top of them, configures the “Municipal Police” domain, ensuring that:

• the citizen experience is consistent, with a single channel and clear statuses;

• operations are traceable, with workflows and end-to-end auditing;

• data is consistent and reusable, with integrated maps, KPIs and reports;

• security and privacy are guaranteed by design, with profiles, controls and retention policies from the outset.

Put simply, the Municipal Police should not “reinvent” login, maps, notifications, document management, evidence or BI. It should consume them as shared capabilities and focus on what is truly specific to its domain: operational rules, enforcement, dispatch, intervention, official reports and processes, with administrative and operational rigour.

“Because what is needed is not ‘just another app’, but a coherent set of shared capabilities that underpin the operation and ensure traceability, security and accountability.”

Rui Mesquita, ICT and Smart Cities - Lagoa Municipality

Lagoa is already ready to integrate

There are clear public signs that the smart city ecosystem in Lagoa has reached a relevant level of maturity. There has been consistent evolution, external recognition and, above all, a platform approach in operation, capable of connecting channels, data and operations. This work is supported by an Operations Centre with continuous operation, structured data collection and the handling of incidents and situations reported by citizens, demonstrating real execution capacity and continuity. (Source: Câmara Municipal de Lagoa)

From an institutional perspective, the creation and regulation of the Lagoa Municipal Police are based on the national legal framework defined by Law No. 19/2004, which establishes the regime governing municipal police forces, and on Regulation No. 1212/2023, which sets out the organisation, responsibilities and operation of the Lagoa Municipal Police. (Source: Diário da República)

At an operational level, the opening of a recruitment process for 24 officers confirms that the service is not merely “on paper”. (Source: Câmara Municipal de Lagoa) It is moving towards becoming operational, with resources and planning.

For the purposes of this proposal, the conclusion is objective. There is a legal basis, there is a political decision and implementation is under way. This means that Lagoa is not starting from scratch. It starts from a context already prepared to integrate the Municipal Police into the platform and turn that integration into concrete gains in operational consistency, response times and public trust.

Case 1 | Incidents and requests: a single channel for citizens and businesses

The first visible impact for citizens and businesses is direct and easy to understand: a single point of entry to report incidents and request intervention from the Municipal Police. This channel should be mobile-first, with map-based location, attachments (photo/video where applicable), clear identification of the request, status tracking and notifications that give citizens greater predictability.

But the real value is not in the form. The value lies in what happens immediately afterwards, when the incident starts being handled as an operational object within the platform:

• triage with basic rules and priority categories, to reduce noise and speed up routing;

• assignment and escalation based on clear criteria (area, priority, type of incident, shift);

• end-to-end history and traceability, so that every interaction is recorded and auditable;

• consistent closure, with standardised outcomes, tags and reasons that enable subsequent analysis;

• operational dashboards, turning incidents into management information (volume, times, geography, recurrence and backlog).

When this cycle operates within the municipal platform, it avoids the classic pattern that consumes time and destroys trust: scattered emails, unrecorded phone calls, loose paperwork, informal forwarding and duplicate requests. Instead, the municipality gains a single, governed and measurable workflow, improving both the citizen experience and internal efficiency.

The practical consequence is important: enforcement stops being purely reactive and starts generating operational knowledge. With structured data, Lagoa can identify critical areas, anticipate seasonal pressure, plan actions and account for its performance based on evidence rather than perceptions.

Case 2 | Field operations: dispatch, intervention and closure

The second impact is internal and, often, the one that frees up the most capacity. The objective is clear: reduce operational friction and increase consistency in the field, ensuring that interventions are fast, properly recorded and defensible, without turning every action into a parallel “administrative process”.

A mobile-first model for officers makes this practical:

• receive the dispatch and work with context, consulting maps, relevant layers and the history of the area, so officers arrive already informed;

• use checklists by type, to standardise frequent interventions (enforcement, traffic/parking, occupation of public space, noise, etc.) and reduce variation between teams;

• record the intervention in seconds, with time, location, decision taken, entities involved where applicable and essential attachments;

• capture evidence with integrity and permissions, ensuring that evidence enters the system with metadata and an auditable trail, without circulating through informal channels;

• close the intervention in just a few steps, avoiding duplicate records and reducing the “post-incident work” that consumes shifts and creates delays in the backlog.

There is an additional benefit here that is rarely mentioned: the platform creates a “single operational truth”. What the officer records in the field appears immediately in the dispatch console and back office, with consistent statuses and history. This facilitates coordination, reduces internal calls, improves shift handovers and prevents information loss.

This use case is particularly relevant for a service that operates in shifts and with a workload that varies by season, where operational pressure increases during periods of greater visitor numbers. In this context, consistency of records and speed of closure are not minor details. (Source: Diário da República) They are the difference between a controlled operation and a service that lives in reaction mode, with accumulated pending work and less capacity for accountability.

In short, when field operations are integrated into the platform, the officer gains time, command gains visibility and the municipality gains traceability. And that is reflected directly in the quality of service provided to citizens.

Case 3 | Processes: from the official report to the archive, with evidence

This is where the “difficult part” lies and, paradoxically, where the most value is lost when the solution is only an isolated application. In an administrative offence process, the objective is not simply to record the intervention. It is to ensure that the record is formally valid, defensible and auditable, from the first minute in the field through to the closure and archiving of the process.

An administrative offence operation requires, at a minimum:

• consistent digital official reports, with validations that prevent formal omissions and ensure mandatory fields by type;

• controlled association of evidence, with attachments and evidence linked to the official report and the process, without “parallel copies”;

• management of deadlines and notifications, with alerts and statuses that reduce the risk of non-compliance and improve predictability;

• integration with records management and archives to ensure a complete case file, versions, classification and retention; (Source: Diário da República)

• end-to-end auditing, to provide an unambiguous answer to who accessed, who changed, what was exported and why.

The regulation reinforces this framework by providing for responsibilities such as issuing official reports and the provisional seizure of objects capable of serving as evidence. This makes the existence of evidence governance and traceability even more critical, because the quality of the record is not a technical detail. It is what supports the validity of the procedure and protects the municipality. (Source: Diário da República)

This is why, in a City as a Platform design, it makes sense to have an Evidence Service that treats evidence as a sensitive and governed asset, with:

• integrity (hash and automatic metadata);

• timestamping;

• handling and export logs;

• permissions by profile and process;

• and mechanisms such as legal hold where applicable.

When this capability is integrated with document management and the process workflow, the administrative offence domain gains real robustness. Duplicate work is reduced, legal and administrative risk decreases and public trust increases, because the municipality can demonstrate, through evidence and audit trails, that every decision had a basis, context and a complete record.

Case 4 | Events and mobility: end-to-end operations

This is the case that brings everything together. Territory, mobility, citizen communication, internal coordination and accountability. It is also where the difference between “having tools” and “having a platform” becomes most evident. (Source: Diário da República)

In a city shaped by events and seasonality, the Municipal Police needs an operational capability that works across three stages.

Before the event

• operational plans for each event, with objectives, team, shifts, critical areas and rules of operation;

• maps of restrictions, with perimeters, road closures, diversions, loading/unloading areas and parking, including specific internal layers and publishable versions;

• preventive communication, with alerts and useful information, to reduce friction and increase voluntary compliance.

During the event

• real-time visibility of the territory, with mobility context where applicable and the ability to adjust priorities;

• alerts and multichannel communication, coordinated with the municipality, to provide information quickly and reduce noise;

• recording of associated incidents and interventions, so that everything that happens is linked to the event, the area and the operational status.

After the event

• post-event report with clear and comparable indicators, including volumes, response times, incidents by area, recurrence and operational workload;

• lessons learned, transformed into practical adjustments (standard plans, positioning, signage, communication, reinforcements).

When the municipal platform already has maps and a citizen channel, the Municipal Police does not enter as a “parallel project”. It enters as an operational domain within the same city logic. This means that the event is not simply “managed on the day”, but planned, executed and evaluated with consistent data, coordinated communication and continuous improvement capacity.

The result is simple to explain, but difficult to achieve without a platform: less improvisation, greater predictability, better mobility, a better public experience and a stronger ability to account for performance through evidence.

Layered architecture: integrating without creating islands

When integrating the Municipal Police into a smart city platform, the most common risk is falling into the “yet another solution” pattern, with duplicated data, parallel workflows and hastily built integrations. The most pragmatic way to avoid that mistake is to design the integration in layers, clearly separating what belongs to the experience, what belongs to shared capabilities and what belongs to the police domain.

A simple (and effective) reference for explaining this approach is:

1. Experience

Citizen/business portal, officer APP, dispatch console and process back office. This is where channels, screens and interactions live. The objective is for everyone to see the same “operational truth”, each according to their profile.

2. Shared platform services

Identity and profiles, GIS, workflow/ticketing, notifications, document management, digital evidence and BI. These are the cross-cutting capabilities that prevent reinvention and ensure consistency, security and faster evolution.

3. Municipal Police domain

Operational rules, enforcement, administrative offences and event/mobility operations. This is the service-specific logic, where types, checklists, statuses, dispatch rules, official reports and process workflows are configured.

4. Integration and data

API management, event bus, connectors and data platform. This is where fragile integrations are avoided and scalability is ensured: data contracts, compatible change management, retry and recovery queues and synchronisation between systems.

5. Cross-cutting governance

Security, auditing, GDPR, observability and resilience. This layer “cuts across” all the others and is not optional. It is what makes the service defensible, traceable and sustainable over time.

What does this solve in practice? It replaces point-to-point “bridges” with governed integration, reduces fragmentation and creates an incremental path for evolution. Instead of a big bang, the platform allows value to be delivered in phases, while maintaining a shared and controlled foundation that supports new use cases without starting again from scratch.

Data, GDPR and security: minimum requirements

Integrating the Municipal Police into a platform is not simply about “more data”. Above all, it involves sensitive data and records with administrative and evidential implications, which impose strong requirements regarding purpose limitation, minimisation, retention, confidentiality and access control. The regulation itself reinforces duties of confidentiality and rules of conduct that require operational and documentary discipline, as well as traceability and accountability regarding who accesses, changes and shares information. (Source: Diário da República)

In a City as a Platform approach, there is a set of minimum requirements that are non-negotiable, because they are what make the service sustainable, defensible and auditable:

• Classification and retention by type
  Different rules for incidents, interventions, official reports/processes and evidence. Operational information does not have the same lifecycle as procedural information, and evidence may require legal hold and preservation trails;

• Identity management with MFA for privileged profiles
  Command, case handling, administration and audit profiles should be protected by MFA, with session policies and access hardening, preventing shared accounts and unauthorised access (MFA means Multi-Factor Authentication);

• RBAC/ABAC applied to context
  RBAC provides access based on role. ABAC provides access based on case, area, process or status. In practice, this means that not every officer, case handler or technician should be able to see everything, and that access should be proportionate and justified;

• Complete and actionable auditing
  Recording of access, changes, exports and relevant queries, with trails that can be used in internal audits and, when necessary, in evidential contexts. Auditing is not a forgotten log, but an operational capability with search, alerts and retention; (Source: Diário da República)

• Evidence integrity and chain of custody
  Digital evidence should have guaranteed integrity (hash), a timestamp, automatic metadata and handling logs. Exports should be controlled, with a stated reason, an authorised profile and a complete record of what has left the system;

• Privacy by design
  Data minimisation, partial masking where applicable, and anonymisation/aggregation for reporting and public dashboards, ensuring that transparency does not result in inappropriate exposure;

• Incident management and monitoring
  Detection and response capabilities, with alerts for anomalous patterns, such as mass exports, centralised logs and, where applicable, integration with SIEM. Incident response should be planned in advance, with defined playbooks and roles.

There is one essential point to underline: governance is not bureaucracy. It protects the validity of the work, reduces institutional risk and strengthens public trust by ensuring that operations are transparent, proportionate, traceable and defensible.

Incremental roadmap: delivering value quickly, without a big bang

The integration of the Municipal Police into the platform should follow an incremental approach, with short delivery cycles, rapid feedback and controlled risk. The rule is simple: avoid a big bang and move forward in phases, each with clear objectives and progression criteria.

1. Preparation (4–6 weeks)

This phase establishes the foundations needed to avoid duplicate work and ensure governance from day one:

• Programme governance (RACI, steering, decision cadence, risk management);

• Design of priority categories and workflows (incident, intervention, official report/process);

• Profiles and permissions (RBAC/ABAC) and access policies for privileged profiles;

• Data model v1.0 and rules for statuses and SLAs;

• Minimum integrations (what goes into the MVP and what remains outside it);

• Definition of retention and evidence requirements (data classes, chain of custody, auditing, controlled export);

Expected outcome: a rigorously planned MVP, ready for implementation, without making “last-minute decisions”.

2. MVP (8–12 weeks)

Delivery of the operational core that creates immediate value and reduces friction in the field:

• Incidents (citizen/business), with geolocation and unique identification;

• Workflow/ticketing with statuses, history and basic SLAs;

• Basic GIS (map, essential layers, location and context);

• Notifications for receipt, status changes and closure;

• Officer app with rapid recording, checklist by type and intervention closure;

• Operational dashboard in the Operations Centre (volumes, times, areas, pending cases).

Expected outcome: the end-to-end cycle “incident → dispatch → intervention → closure” is operational and measurable.

3. Consolidation (3–6 months)

This phase focuses on administrative robustness and integration with the internal ecosystem:

• Process/administrative offence module (digital official reports and stage-based handling);

• Management of deadlines and formal notifications (alerts, statuses, proof of sending/action);

• Integration with document management/archive systems for case files and preservation;

• Initial operational integrations with mobility/parking, where relevant;

• Quality and control (actionable auditing, evidence export rules, UX and data improvements);

Expected outcome: defensible processes, stronger traceability and reduced operational risk.

4. Scale (6–12 months)

The maturity phase, with assisted automation and consistent accountability:

• Advanced BI with service, quality and capacity KPIs;

• End-to-end event operations (planning, execution, communication and reporting);

• IoT and contextual integrations (alerts, area-based correlation, automatic task creation where applicable);

• Seasonality optimisation (resource adjustment, period-based SLAs, simple forecasting);

• More detailed quality/service metrics (reopenings, recurrence, record completeness, productivity with quality);

Expected outcome: a more predictive, more integrated operation with a stronger ability to demonstrate performance and accountability.

KPIs: measure, improve and account for performance

Without indicators, the platform is simply another piece of software. With indicators, it becomes a public management tool, because it supports data-driven decisions, helps justify choices and enables continuous operational improvement.

When integrating the Municipal Police into City as a Platform, KPIs should balance three dimensions: service to citizens, operational efficiency and administrative/process robustness.

Below is a recommended set, focused on metrics that are actionable and comparable over time.

Recommended KPIs

• Mean Time to Acknowledge/Triage (MTTA) and Mean Time to Resolution/Closure (MTTR), by type and area
  Measures actual response capacity and helps adjust resources, triage rules and priorities;

• SLA compliance and operational backlog
  Percentage within SLA, volume of pending cases by status and the “age” of the backlog. This is the core metric for capacity and operational risk;

• Recurrence by area and type (heatmaps)
  Identifies territorial patterns and supports preventive interventions, increased enforcement or coordinated action with other services;

• Resolution rate without reopening
  Percentage of closed incidents that are not reopened within a defined period. Measures the quality of closure and reduces rework;

• Process time (administrative offences and processes)
  Time by stage, including official report, notification, case handling and decision, as well as the percentage of deadlines at risk or missed. This is critical for administrative robustness and compliance;

• Citizen satisfaction at closure (CSAT) and record quality
  Simple CSAT score, for example 1–5, combined with record quality measured through completeness and consistency, including mandatory fields completed, valid location, evidence where applicable and correct classification;

• Productivity by team and shift, combined with quality metrics
  Interventions by shift/team, always balanced with quality indicators such as reopenings, formal defects, evidence failures and excessive time by stage. The objective is not simply to “do more”, but to do it well and in a defensible way.

Practical note on KPI governance

To prevent these metrics from becoming just another “report sitting in a drawer”, the following should be defined from the outset:

• frequency (daily/weekly/monthly);

• responsibility for reviewing the metrics and making decisions;

• two or three standard actions when a KPI falls outside the expected range, for example reinforcing triage, adjusting a category, reviewing an SLA, training teams or correcting integrations.

Conclusion: a city that learns and protects

In the article “The Smart City That Learns”, the central idea is clear: a smart city is not defined by gadgets, but by its ability to turn data into action, supported by clear processes, consistent operations and continuous learning. This principle becomes even more relevant when the subject is local security and the protection of public space, where trust depends on traceability, proportionality and evidence.

Bringing the Municipal Police into City as a Platform means applying this same operating model to the field of urban protection. It means ensuring, in an integrated way:

• a single channel for citizens, with simple submission, status tracking and transparent communication;

• traceable operations for the service, with triage, dispatch, intervention and closure recorded and auditable;

• robust evidence and processes for the municipality, with digital evidence managed with integrity, chain of custody and consistent process management;

• data and accountability for the community, with indicators that make it possible to measure response times, quality, territorial recurrence and the impact of the measures adopted.

The desired outcome is not simply “to have a Police app”, because that would only add another technological layer. The objective is more ambitious and more useful: to give the city a digital capacity for protection, capable of connecting territory, operations and decision-making within a coherent model. A city where an incident is not lost, an intervention does not become invisible, evidence is not left vulnerable and processes do not depend on improvisation.

When the Municipal Police becomes part of the platform, the municipality reaches a new level of maturity. It stops responding purely “case by case” and begins operating with memory, context and continuous improvement. And that is where the smart city becomes complete: not simply because it observes and manages, but because it also protects, with rigour, transparency and trust, day after day.