A single per-activity rule when creating or updating a pass/membership. access: included adds the activity to coverage (under selected scope) or just carries a creditCost override (under all scope); access: excluded blocks the activity. creditCost is the number of credits the activity consumes (null = default 1; must be >= 0 when provided; ignored when excluded).