Firewall rules exist in chains. One possible firewall action is to jump into a chain, the packet then passes through the rules within that chain from top to bottom. When you specify an action of jump, you also specify a target as the chain to jump into.
The first dynamically installed rule illustrates this:
chain=forward action=jump jump-target=hs-unauth hotspot=from-client,!auth
In the forward chain, if the packet is coming from the client and the client is not authenticated (hotspot=from-client,!auth) jump into the hs-unauth chain.
Edit: the 3.0 documentation has a fairly good run down on customizing Hotspot firewall rules:
http://www.mikrotik.com/testdocs/ros/3. ... otspot.php
The dynamically installed 4.x rules are different but once you understand the 3.x ruleset explained in the docs the 4.x one isn't difficult.