final protected function _validatePolicyAtChange() {
        //validate that required indices exist
        if (!isset($this->_userProfile['username'])
            || !isset($this->_userProfile['password'])
            || !isset($this->_userProfile['fullname'])
            || !isset($this->_userProfile['passhist'])
         ) {
            throw new UserCredentialException('The username and password are not set', 1016);
        }

        //determine which entropy to use (base or udf)
        $policyObj = $this->_udfPasswordPolicy;
        
        //check password repeat
        $passHistory = $this->_userProfile['passhist'];
        $passHistoryRequired = array_slice($passHistory, 0, ((int) $policyObj['password_repeat_minimum']));
        
        //iterate and verify
        foreach ($passHistoryRequired as $passHistoryItem) {
            if (password_verify($this->_userProfile['password'], $passHistoryItem)) {
                throw new UserCredentialException('User cannot repeat any of their ' . $policyObj['password_repeat_minimum'] . ' last passwords', \USERCREDENTIAL_ACCOUNTPOLICY_REPEATERROR);
            }
        }
        
        return true;        
    }