Microservice AuthZ and scopes

Question for y'all regarding authorization in microservice.

My company is moving from monolith to microservices and we are rolling out own AuthN and authZ. For authorization, we are attaching user scopes to the request header and pass it to a service.

In the service we have required scopes which is an array of string. In the middleware we check required scopes against user scopes.

My questions are:
1. Can an endpoint return additional data based on non required user scopes?
2. What should the scope check entail? Just checking against the strings, or should it hold some logic?
3. How do u guys tackle such problem at ur company?