restrict local-policy in case of diverted call

Can we somehow allow calls in local-policy based on non-defined from-address, if the call is a diverted/forwarded call?

as an example:

local-policy  allows calls only from certain extensions (to avoid that any random spoofed extension just tries to make any calls)

from-address +372669116

to-address *

source-realm PBX

next-hop access

We have an inbound call from access to PBX user

inbound call

from-address +3726505273

to-address +3726691168

source-realm access

next-hop: PBX

+3726691168 is forwarded to +3726505270

so, there is an outbound call to:

from-address +3726505273

to-address +3726505270

source-realm PBX

next-hop access

effectively, our local policy would respond with "no routes found", but as the SIP INVITE message includes a