Explain the difference in when and using in access policies

[raddevon]

Elvis:

There used to be a semantic difference, but it no longer exists. Right now the difference is mostly aesthetic: I'd use when to "gate" an access policy on some global condition (such as a logged-in user type), and using for an actual filtering expression,
e.g

when ((global user).group != "admin")
using (not .protected)

The access policy groups RFC would make when more useful since you wouldn't need to restate it for a group. Not sure if this will be implemented or not.