In this work, we explore algorithms for answering conjunctive RDF queries in the presence of RDFS ontologies and access control. We consider an access control setting where by default all users have access to the complete graph, and a restriction can forbid user a user’s access to specific IRIs. Here, restricting for user u the access to an IRI i entails that: no answer to a query by u may contain the IRI i; no triple containing i can be used to compute an answer for a query by i, nor to entail such a triple via reasoning with the ontology. We present a set of query answering algorithms for this novel context, and prove that five among them are correct, i.e., sound and complete, with respect to both the ontology and the access restrictions in place. We have implemented all our algorithms and present experiments comparing their performance.