Encryption

1. The file is encrypted using a password. It can be used for opening the file and/or editing it.

If you choose both don't use the same password, of course. The user needs to have the file-open password in order to be able to open the file. The file-edit password can be used to remove both restrictions.

2. The file is encrypted using a certificate file. The user needs to have a copy of this file to be able to open the PDF. The policy can also limit certain editing actions.

Applying just the file-edit policy (backed by a password) is not very secure, though. The file-open policy and the certificate-backed policy encrypt the file's entire contents, so they are more difficult to get around, but not impossible.