diff --git a/syntaxes/spicedb.tmGrammar.json b/syntaxes/spicedb.tmGrammar.json
index e654ac9..de3209d 100644
--- a/syntaxes/spicedb.tmGrammar.json
+++ b/syntaxes/spicedb.tmGrammar.json
@@ -131,7 +131,7 @@
     },
     "permission": {
       "comment": "definition of a permission",
-      "begin": "(permission\\b)\\s+([a-zA-Z_]\\w*)\\s*(=)\\s*",
+      "begin": "(\\bpermission\\b)\\s+([a-zA-Z_]\\w*)\\s*(=)\\s*",
       "beginCaptures": {
         "1": {
           "name": "keyword.function.relation"
@@ -165,7 +165,7 @@
     },
     "relationRef": {
       "comment": "relation reference",
-      "match": "([a-zA-Z_]\\w*)",
+      "match": "([a-zA-Z_]\\w*)\\b(?!->|\\.(?:any|all)\\()",
       "captures": {
         "1": {
           "name": "entity.name.variable"