Difference between WHEN rule and Access WHEN in Pega

Pega has two rule types that both test a condition and both have "When" in their name, so it is easy to mix them up. The difference is where the condition is used. A When rule drives behaviour. An Access When rule drives security.

When rule

A When rule (Rule-Obj-When) is a named true or false condition that you can reuse in flows, decisions, section visibility and so on. Examples: "Is the amount over 10,000?", or "Is the customer a premium customer?". When the answer is true, something happens, such as a field appearing or a flow branching.

Access When

An Access When rule (Rule-Access-When) is a condition used in the access control rules, such as an Access of Role to Object. It decides whether the operator is allowed to perform an action on a particular record. Because the condition is evaluated against the record and the operator, it lets you give access to some rows of a class and not others.

Comparison

	When rule	Access When rule
Purpose	Business logic and user interface conditions	Record-level access control
Used by	Flows, decision rules, sections, activities	ARO and other access rules
Answers	"Should this happen?"	"May this operator do this to this record?"
Result of false	Branch or field not shown	Access refused

A worked example

A bank wants branch staff to update only accounts from their own branch.

Create an Access When rule IsOwnBranch that compares .BranchCode on the record with the operator's branch code.
In the ARO for the Account class, set the Update right to apply only when IsOwnBranch is true.
A clerk in branch 12 can now update accounts with branch code 12, and can only view the rest.

Meanwhile, a plain When rule IsHighValue might decide whether the "Manager approval" section appears. It has nothing to do with security. It is only about what the form shows.

Tips

Keep Access When conditions fast. They may be evaluated for many records, for example when building a list.
Do not use a plain When rule to hide a field and call it security. A user who can reach the record by another route will still see the data.
Test with operators from different groups.

Interview tip

Give the one-line contrast, logic versus security, then the branch example. Related: What is Pega ABAC?, Access of Role to Object and the Security label.