A role-aware, locally deployed LLM architecture for trustworthy building energy analytics

Large language models (LLMs) may make building energy analytics more accessible, but their use in operational environments raises governance risks because high-resolution metering data may reveal occupancy patterns, routines, or other sensitive information. This paper presents a role-aware, locally deployed LLM architecture for policy-enforced building energy analytics. The architecture combines a web-based conversational interface, local LLM inference, Model Context Protocol (MCP) tools, and an external policy engine. The contribution is the architectural integration and prototype-level validation of local LLM inference, MCP-mediated tool access, external policy enforcement, role-aware context mediation, and audit logging for building-energy analytics; no novelty is claimed for these individual technologies. The architecture is evaluated in a real office-building case study using 5-second electricity metering data. A property-based validation protocol is applied, including role-specific tool listings, nominal and boundary prompts, policy-decision traces, MCP tool-call logs, and inspection of structured outputs injected into the model context. The results show that non-administrative roles received only policy-authorised aggregations and fields in the evaluated scenarios. Relative to the native 5-second resolution, 15-minute aggregation reduced the number of time-series records presented to the model per day from 17,280 to 96, corresponding to a 180-fold record-count reduction. Daily aggregation reduced the number to one record, corresponding to a 17,280-fold record-count reduction. Requests for unauthorised streams or finer temporal resolution were denied. The findings are limited to prototype-level validation of selected governance properties in one office building, using one local LLM configuration and a controlled prompt suite; they do not establish general applicability across buildings, models, or workloads. The evaluation does not assess the numerical accuracy, diagnostic correctness, factual correctness, or reliability of the LLM-generated building-energy analyses. The architecture provides a prototype-level reference design for integrating LLMs into building energy analytics while reducing the number of time-series records presented to the model and improving traceability.