If you’re allowed to create an additional step in workflow, you can do that way as it will be having plan variable. But it is not recommended to modify the workflow for one generic usecase.
That’s the reason I suggested the advanced policy usage, though you might not have plan variable, you can still get the requested items by comparing between current identity and future identity. You can refer this to get comparisions - Advanced Policy Violation Rule
This has role comparision, but in similar way you can also get requested entitlements and compare