Not all that much here not already in other answers, but for (more) completeness I'll quote Rabenu Asher ("Rosh"), in his halachos to P'sachim 7B (in my own loose translation):
Rabenu Tam explained that all mitzvos done immediately, we say "al" on, like "al mikra m'gila", "hat'vila", "n'tilas yadayim", "hafrashas t'ruma", "achilas matza" and "maror". But "l'haniach t'filin", "l'his'atef batzitzis", "leshev basuka" — these involve delay. The wording ["l'-"] implies as much: "to be adorned with t'filin", "to be wrapped in tzitzis", "to dwell in a suka, eating and spending all day". As to "l'hadlik ner Chanuka", it, too, has delay: the mitzva is "from sunset until traffic leaves the street". Likewise "lishmoa kol shofar: there's delay among the blasts, as the main mitzva is blowing with each b'racha [of the amida]. The difference between halel ("l'-") and m'gila ("al") is that the latter is read straight through whereas halel has pauses for responsive reading. Moreover, halel was originally meant to be read for the community's being saved from any trouble, so we use "l'-": any mitzva that's not a steady obligation doesn't get "al". "L'hachniso" [at a b'ris] is because it's not a b'racha on the mitzva at all (it's not even said beforehand), but one of praise for having the mitzva. And hand t'filin get "l'-" while the head get "al" because the rabbis didn't want to have two the same in a row; the head gets "al" as it's the final part of the mitzva.
Riva differed: On any mitzva than can be done via an agent, say "al"; on others, "l'-". That's why the g'mara implied that "lamul" means he himself circumcises. Shofar gets "l'-" because he must hear it himself; halel, unlike m'gila, because even one hearing halel from another must say certain parts. Even though personal t'vila can't be done through agency, that of dishes can, so both got "al"; moreover, because of t'vila of converts, which gets "al" because it's said only after the mitzva is done. Similarly lulav: sometimes the b'racha is made after the mitzva is done, so it gets "al"; and the same for n'tilas yadayim. ("L'-" implies future.) Chanuka lights get "al" even though agency works because people don't use agents for it: everyone likes to light his own (they love the miracle); same for Shabas lights. Omer counting gets "al" because the congregational leader counts aloud for those who can't. As for t'filin, the b'racha is really "...v'mitzvas t'filin" [neither "al" nor "l'-"] (and Rif agrees with that). Likewise, "laasok b'divre sora" is the correct wording of that b'racha, per the Ashk'naz wording.
According to Riva, one would therefore say "leechol matza" and "leechol maror".
Thus, Rabenu Tam holds that it depends on immediacy of the mitzva only, except that an exception is made when two birchos hamitzva are done in a row or when the mitzva is required under unplanned, occasional circumstances (or something like that). Riva holds that it depends on whether the mitzva is (at least under some circumstances) often done by an agent and on whether the b'racha is (at least under some circumstances) said after the mitzva is done: if either is true, say "al".