When to use On-Demand Auth vs Client Cert Auth

I see at my workplace a mix of policies using Client Cert Auth vs On- Demand Auth, but it’s not clear WHY one is preferred over the other. I have read some articles about what happens when you use each one, but could you provide specific examples of when you’d use one over the other? Like what sort of application needs one over the other? Because I don’t see how using one over the other makes a difference in the end goal.