If Differential is set to a restrictive "Can Use Application" setting, the Diffusion commit page (/rXnnnn) fails. Specifically, the call stack looks like:

DiffusionCommitController->processRequest()
DiffusionPathChange::convertToDifferentialChangesets()
DifferentialDiff::newFromRawChanges()
DifferentialDiff::initializeNewDiff()

Broadly, Diffusion creates a DifferentialDiff as part of its internal rendering logic, but that hits standard pathways and throws when trying to pull default policies.

One reasonable approach might be to add a new DifferentialDiff::initializeEphemeralDiff() or similar, which skips the policy query and uses makeEphemeral() to make sure it isn't persisted.

WMF is affected because they don't want users touching Differential yet.