                     // destination resource must be visible
                     if self.permissionsEnabled {
                         
-                        if self.delegate?.server(self, permissionForRequest: request, managedObject: resource, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
+                        if self.delegate?.server(self, permissionForRequest: request, managedObject: newValue, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
                             
                             return ServerStatusCode.Forbidden
                         }

                // to-many relationship
                else {
                    
                    // must be array of numbers
                    let destinationResourceIDs = jsonValue as? [UInt]
                    
                    if destinationResourceIDs == nil {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    let (newValue, error) = self.fetchEntity(relationship!.destinationEntity!, withResourceIDs: destinationResourceIDs!, usingContext: context, shouldPrefetch: false)
                    
                    if error != nil {
                        
                        return ServerStatusCode.InternalServerError
                    }
                    
                    // make sure all the values are present and have the correct permissions...
                    
                    if newValue!.count != destinationResourceIDs?.count {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    for destinationResourceID in destinationResourceIDs! {
                        
                        let destinationResource = newValue![find(destinationResourceIDs!, destinationResourceID)!]
                        
                        // destination resource must be visible
                        if self.permissionsEnabled {
                            
                            if self.delegate?.server(self, permissionForRequest: request, managedObject: resource, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
                                
                                return ServerStatusCode.Forbidden
                            }
                        }
                    }
                    
                    // pointer

                // to-one relationship
                if !relationship!.toMany {
                    
                    // must be dictionary
                    let destinationResourceDictionary = jsonValue as? [String: UInt]
                    
                    if destinationResourceDictionary == nil {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    // resource dictionary must have 1 value-key pair
                    
                    if destinationResourceDictionary!.count != 1 {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    // get key and value
                    
                    let destinationResourceEntityName = destinationResourceDictionary!.keys.first!
                    
                    let destinationResourceID = destinationResourceDictionary!.values.first!
                    
                    let destinationEntity = self.managedObjectModel.entitiesByName[destinationResourceEntityName] as? NSEntityDescription
                    
                    // verify that entity is subentity
                    if (destinationEntity == nil) || !(destinationEntity?.isKindOfEntity(relationship!.destinationEntity!) ?? true) {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    let (newValue, error) = self.fetchEntity(destinationEntity!, withResourceID: destinationResourceID, usingContext: context, shouldPrefetch: false)
                    
                    if error != nil {
                        
