Short Answer: ActAs is intended to be used for identity delegation scenarios. OnBehalfOf is intended to be used for STS proxy scenarios.

Long Answer:

ActAs scenario -
1. Client authenticates to middle tier service using some token, T1.
2. Middle tier services authenticates to STS with its own token, T2, presenting T1 in the RST body as an ActAs element.
3. STS issues a token, T3, containing claims based on both T1 and T2.
4. Middle tier service presents T3 to backend service, hence 'acting as the client', backend service can see both sets of claims.

OnBehalfOf scenario -
1. Client authenticates to STS proxy using some token, T1, which is a front end for an STS sitting behind a firewall for example.
2. STS proxy forwards the request to the backend STS, presenting T1 in the RST body as an OnBehalfOf element.
3. STS issues a token, T2, that contains claims based only on T1.
4. STS proxy forwards this returned token back to client.
5. Client uses T2 to authenticate to some service which trusts the STS.

You can imagine a composite scenario where there is both an STS proxy and a middle tier service, hence its very possible to combine both concepts.

Short Answer: ActAs is intended to be used for identity delegation scenarios. OnBehalfOf is intended to be used for STS proxy scenarios.

Long Answer:

ActAs scenario -
1. Client authenticates to middle tier service using some token, T1.
2. Middle tier services authenticates to STS with its own token, T2, presenting T1 in the RST body as an ActAs element.
3. STS issues a token, T3, containing claims based on both T1 and T2.
4. Middle tier service presents T3 to backend service, hence 'acting as the client', backend service can see both sets of claims.

OnBehalfOf scenario -
1. Client authenticates to STS proxy using some token, T1, which is a front end for an STS sitting behind a firewall for example.
2. STS proxy forwards the request to the backend STS, presenting T1 in the RST body as an OnBehalfOf element.
3. STS issues a token, T2, that contains claims based only on T1.
4. STS proxy forwards this returned token back to client.
5. Client uses T2 to authenticate to some service which trusts the STS.

You can imagine a composite scenario where there is both an STS proxy and a middle tier service, hence its very possible to combine both concepts.