We present an architecture based on Social Linked Data (Solid) and W3C Web of Things (WoT) that enables controlled access to composite IoT devices and their data. The architecture allows for stakeholders to interact with the composite device and to read and write data, provided they are authorized. For fine-grained access control, data is stored in nested Linked Data Platform (LDP) containers that reflect the structure of the composition itself. The composition structure is derived from a hierarchy of WoT Thing Descriptions (TDs). The architecture relies on an orchestration component to couple IoT devices and the Solid data store and is straightforward to implement with existing software.