@classmethod
def validate_rbac_policy_update(cls, resource, event, trigger, payload=None):
    """Callback to handle RBAC_POLICY, BEFORE_UPDATE callback.

        :raises: RbacPolicyInUse -- in case the update is forbidden.
        """
    policy = payload.latest_state
    prev_tenant = policy['target_tenant']
    new_tenant = payload.request_body['target_tenant']
    if prev_tenant == new_tenant:
        return
    if new_tenant != '*':
        return cls.validate_rbac_policy_delete(resource, event, trigger,
            payload=payload)
