# How to Add AI to Kronos Workforce Central (On-Prem) Privately > Source: https://netray.co/erp-help/private-ai-layer-ukg-kronos-workforce-central-on-prem-architecture > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer Workforce Central holds some of the most sensitive data a plant owns: hours, pay codes, schedules and personal data. A private layer keeps it inside your network by reading from a replica or reporting copy, using the WFC integration interfaces for anything live, mirroring access profiles, and running an open-weight model on local GPUs. Pay calculation stays in Kronos. ## Kind advanced ## System mfg-systems ## Erp UKG Kronos Workforce Central (on-prem) ## Module Timekeeping and Scheduling ## Query how to add AI to Kronos Workforce Central on-prem ## Alternate Queries - Kronos Workforce Central AI integration without cloud - UKG Kronos WFC reporting database query for AI - private AI assistant for timekeeping data ## Applies To Kronos Workforce Central 7.x and 8.x on SQL Server or Oracle. Table, view and API names vary by version; confirm against your data dictionary and API guide. ## Steps ### Stand up a private assistant over timekeeping data **Items:** - Agree the scope with HR, payroll and legal: which questions are in (overtime trends, schedule coverage, exception counts, policy lookups) and which are out (individual disciplinary decisions, pay disputes). - Restore a nightly or log-shipped replica of the Kronos database, or use the reporting database your team already runs, on a separate server with a read-only login. - Document the views and tables you will use for people, timesheet items, totals, pay codes, labor accounts and schedules, and validate them against the data dictionary for your version. - Build a semantic layer of approved, named queries (for example overtime_by_department) so the model calls reviewed SQL instead of writing free SQL against raw tables. - Load policy documents, union agreements and pay rules into a local retrieval index for rules questions. - Mirror access: map Kronos function access profiles and employee groups to the asking user and filter every result set by the people that user manages. - Log every question, query and answer, and mask or suppress small groups where the count could identify a person. ## Sections ### Data access paths in Workforce Central **Body:** Workforce Central stores people, punches, timesheet items, totals, pay codes, labor accounts and schedule data in a relational database. Common objects include PERSON and employee tables, timesheet item and totals tables, and reporting views that Kronos ships for report writers. Names and columns differ by release, so do not copy table names from a forum; take them from the data dictionary supplied with your version and your own report definitions. For live reads and controlled operations, Workforce Central offers an XML request and response API over HTTP and the Integration Interface Manager for scheduled imports and exports. Use these for anything that must reflect the current state, such as the current approval status of a timecard. Use the replica for analytics and trends. Never connect an assistant to the production database with a writer account. **Code:** -- Illustrative only: confirm the view and column names in your WFC data dictionary SELECT d.DEPT_NAME, p.PAYCODE_NAME, SUM(t.HOURS) AS HOURS FROM VP_TOTALS t JOIN VP_EMPLOYEE e ON e.PERSONID = t.PERSONID JOIN DEPT_REF d ON d.ID = e.DEPTID JOIN PAYCODE_REF p ON p.ID = t.PAYCODEID WHERE t.APPLYDATE >= DATEADD(day, -28, GETDATE()) AND p.PAYCODE_NAME LIKE 'Overtime%' GROUP BY d.DEPT_NAME, p.PAYCODE_NAME ### Reference architecture **Body:** Reference architecture used on every page of this series: (1) a read-only replica or reporting copy of the data, (2) change capture so the index stays current, (3) a retrieval index with the source ACLs stored beside every chunk, (4) a tool server (MCP or plain HTTP) that exposes only approved read actions, (5) an open-weight model served with vLLM or Ollama on local GPUs, (6) an append-only audit log. For Kronos the replica and the semantic layer matter more than the retrieval index. Most questions are numeric, so the model should pick a parameterized, reviewed query and explain the result, not invent SQL. A tool server exposes named tools such as get_overtime_summary(department, date_range) and get_schedule_gaps(site, week). Parameters are validated, results are capped, and each tool applies the asking user's scope. A small document index covers policy text, union agreements and rounding or grace rules. In an air-gapped plant the replica, tool server and model run in the same network zone as the Kronos application servers. ### Permissions, privacy and compliance **Body:** Workforce Central controls what a manager sees with function access profiles, display profiles and employee groups or transfer rules, and those differ per user. Your layer must compute the set of employees the asking user may see and apply it to every query. An HR director, a supervisor and a payroll clerk should get different answers to the same question. This data is regulated personal data. Depending on country and site, rules on biometric templates, works councils, wage and hour laws and union agreements apply. The architecture can help the customer meet these obligations: no data leaves the site, access is logged, small groups are suppressed and the model is not used to make employment decisions. Netray does not certify compliance; your legal team decides what use cases are allowed. ### Sizing, rollout, write-back and limits **Body:** Timekeeping data is small compared with documents. A plant of 5,000 employees produces millions of punch and total rows per year, which a replica handles easily. Model load is driven by the number of managers and HR users, typically hundreds, so a single GPU serving a 7B to 14B model is often enough for a pilot. The sizing calculator lets you test this. Phase one: read-only analytics and policy questions. Phase two: drafts, for example a schedule coverage note or a timecard exception summary a supervisor reviews. Phase three: approved actions through the WFC API, such as adding a comment or submitting an approval, with the supervisor confirming each one. Do not let a model change pay codes or edit punches. Version limits: older 6.x builds may lack documented APIs, and UKG's own cloud analytics may be enough if you are moving to Dimensions soon. ## Pitfalls - Letting the model write free SQL against raw tables. Joins on effective-dated data are easy to get wrong and the result looks plausible. - Ignoring pay rules and rounding. Hours in a view may not equal paid hours; always state which one the answer used. - Forgetting small-group privacy. An overtime figure for a team of two identifies a person. - Mixing all roles in one service account. Mirror function access profiles and employee groups or the assistant leaks data across departments. - Using the assistant for decisions about individuals. Keep it to aggregates, exceptions and explanations. - Copying table names from the web. They differ across Kronos releases. ## Ai Angle ERPray's pattern fits timekeeping: read-only access, the query shown with every answer, and the asking user's own role applied. Netray can build the semantic layer and the policy index with your payroll and IT teams. If you only need prebuilt reports and alerts, Kronos reporting or UKG's own analytics may already do the job. ## Faq ### Is it safe to put timekeeping data in front of an LLM? **Answer:** It can be, if the model runs on your own servers, reads a replica, applies each user's Kronos access scope, suppresses small groups and logs everything. The model should explain approved queries, not decide anything about individuals. ### Which Kronos tables should we use? **Answer:** Take them from the data dictionary and reporting views for your Workforce Central version, not from examples online. Build named, reviewed queries over them and test the totals against a known report before the assistant uses them. ### Can the assistant approve timecards? **Answer:** Only through the supported WFC API and only after a named supervisor confirms each action. Start with read-only exception summaries; most teams never need to automate approvals. ### Do we need a big GPU for this? **Answer:** Usually not. Users are managers and HR staff, in the hundreds, and questions are short. One GPU serving a 7B to 14B model is a common pilot size; the calculator shows how it scales. ### What about the move to UKG Dimensions? **Answer:** If you will migrate within a year, a thin read-only layer on the replica is cheap and the semantic layer can be repointed later. If migration is imminent, evaluate vendor tools in the target platform first. ## Search terms kronos workforce central ai, ukg kronos on-prem ai integration, kronos wfc reporting database, timekeeping data private llm, kronos api integration, kronos overtime analytics ai, workforce central replica reporting, air-gapped timekeeping ai --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json