How do folks feel about auto-fail criteria on a scorecard? Does this properly incentivize desired behavior? Or does it just feel punitive?

I think it depends on many things.  

What is the possible impact on the company for failing this point? Legal, Financial?  

Is the point an important metric that you need and compliance is low no matter how many times you've made the point?  

In general I'm not a fan of auto-fail, but in cases where GDPR or HIPAA comes into play, it may be a necessity. 

Hm, what would trigger the auto-fail, can you give an example? In general, I would say that an auto-fail would also need a nuanced explanation from a reviewer, but I feel like I'm missing a bit of information :)