Hi Luciano
We recently implemented exactly what you need for a client.
The client published the agents' clock-in/clock-out/break times via an API.
We developed a Chrome extension that, when an agent tries to log in, triggers the extension, checks the agent's working hours, and if they are outside of those hours, it prevents login; if they are within those hours, it allows login.
Similarly, for breaks, the system only allows breaks to be scheduled within the hours according to the API response.
If breaks or login are not autorized, a message is displayed.
There is obviously a point of failure... if the extension is not installed, this check is not validated.
A suggestion in this case would be to use IP-based blocking configuration, thus further restricting access.
------------------------------
Kaio Oliveira
GCP - GCQM - GCS - GCA - GCD - GCO - GPE & GPR - GCWM
PS.: I apologize if there are any mistakes in my English; my primary language is Portuguese-Br.
------------------------------