                     // destination resource must be visible
                     if self.permissionsEnabled {
                         
-                        if self.delegate?.server(self, permissionForRequest: request, managedObject: resource, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
+                        if self.delegate?.server(self, permissionForRequest: request, managedObject: newValue, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
                             
                             return ServerStatusCode.Forbidden
                         }

                // to-one relationship
                if !relationship!.toMany {
                    
                    // must be number
                    let destinationResourceID = jsonValue as? UInt
                    
                    if destinationResourceID == nil {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    let (newValue, error) = self.fetchEntity(relationship!.destinationEntity!, withResourceID: destinationResourceID!, usingContext: context, shouldPrefetch: false)
                    
                    if error != nil {
                        

                // to-many relationship
                else {
                    
                    // must be array of dictionaries
                    let destinationResourceIDs = jsonValue as? [[String: UInt]]
                    
                    if destinationResourceIDs == nil {
                        
                        return ServerStatusCode.BadRequest
                    }
                    
                    // verify dictionaries in array and create new value array
                    
                    var newArrayValue = [NSManagedObject]()
                    
                    for destinationResourceDictionary in destinationResourceIDs! {
                        
                        // resource dictionary must have 1 value-key pair
                        if destinationResourceDictionary.count != 1 {
                            
                            return ServerStatusCode.BadRequest
                        }
                        
                        // get key and value
                        
                        let destinationResourceEntityName = destinationResourceDictionary.keys.first!
                        
                        let destinationResourceID = destinationResourceDictionary.values.first!
                        
                        let destinationEntity = self.managedObjectModel.entitiesByName[destinationResourceEntityName] as? NSEntityDescription
                        
                        // verify that entity is subentity
                        if (destinationEntity == nil) || !(destinationEntity?.isKindOfEntity(relationship!.destinationEntity!) ?? true) {
                            
                            return ServerStatusCode.BadRequest
                        }
                        
                        let (newValue, error) = self.fetchEntity(destinationEntity!, withResourceID: destinationResourceID, usingContext: context, shouldPrefetch: false)
                        
                        if error != nil {
                            
                            return ServerStatusCode.InternalServerError
                        }
                        
                        if newValue == nil {
                            
                            return ServerStatusCode.Forbidden
                        }
                        
                        // destination resource must be visible
                        if self.permissionsEnabled {
                            
                            if self.delegate?.server(self, permissionForRequest: request, managedObject: newValue, context: context, key: nil).rawValue < ServerPermission.ReadOnly.rawValue {
                                
                                return ServerStatusCode.Forbidden
                            }
                        }
                        
                        // add to new value array
                        newArrayValue.append(newValue!)
                    }
                    
                    // pointer
