Oauth Scope Check

I've got a access_token from my BigIP Oauth Authorization Server for grant_type as client_credentials with invalid scope. As you can see from the response from /introspect, both scope and scope_data is empty.

I am wondering why the Oauth Scope Check in the Per-Request-Policy is still evaluated as Allow (subsession.oauth.scope.last.authresult == 1)? Should it give Deny as the evaluation result for this Per-Request-Policy? Is it possible for me to manually check the size of "scope_data" in that response in when ACCESS_PER_REQUEST_AGENT_EVENT if size of that array is < 1, I'd like manually reset subsession.oauth.scope.last.authresult to 0

oauth scope check to /f5-oauth2/v1/introspect has following response:

{

  "active":true,

  "client_id":"68ebc48eb2a84a096e8589eb141900505686049f7743c05d",

  "username":"/Common/oauthas-ap.vsasdao",

  "token_type":"Bearer",

  "exp":1573213401,

  "iat":1573209801,

  "nbf":1573209501,

  "sub":"/Common/oauthas-ap.vsasdao",

  "scope":"",

  "scope_data":[

  ]

}