Gemini `finishReason: PUP_LIMITED_DISABLED` and `ESCALATION` — the two rows with no lever in them

"candidates": [{"finishReason": "PUP_LIMITED_DISABLED"}] <-- the row names your account, not your request

Every other string this site documents points at something you can change: a cap, a schema, a tool list, a prompt. These two do not. PUP_LIMITED_DISABLED attributes the stop to the state of an account; ESCALATION attributes it to a rule it declines to name. If one of them is in your log, the question you actually have is not “what do I fix” but “what happened to my access” — and the honest headline of this page is that the documentation does not answer that question, and this page will not pretend to. What follows is both rows verbatim out of a copy of the reference that was already on this lab’s disk, everything the two sentences do establish, and a careful account of where the files stop.

In ten seconds. Both are values of FinishReason, whose one-line intro is “Defines the reason why the model stopped generating tokens.”. They are the last two rows of that enum — positions twenty-one and twenty-two of twenty-two, adjacent, one unbroken 210-character run, with MALFORMED_RESPONSE before them and nothing after. Neither is a member of BlockReason, the six-value enum whose quoted field says the prompt “was blocked and no candidates are returned”. So neither string can have arrived on promptFeedback.blockReason: the only field either one can come off is candidates[0].finishReason.

What the two sentences establish. For PUP_LIMITED_DISABLED, that generation stopped, that the stated cause is an account being “limited or disabled”, and that the stated grounds are Prohibited Use Policy violations. Measured in characters, that row is the longest of the twenty-two — 134 characters against 119 for the next longest, SPII — so whatever else is wrong with it, it is not one of this enum’s terse rows. For ESCALATION, almost nothing: “Request was filtered by an escalation rule.” defines no term in it. The word escalation appears exactly one time in the 1,232,462-byte reference — this row — and zero times in the Terms of Service, the troubleshooting guide and the safety-settings guide. Nothing in the request schema names an escalation rule, so there is no setting to inspect and none to turn off.

And the part this page exists to get right. PUP_LIMITED_DISABLED names a real, findable policy, which makes it tempting to tell you how to appeal, who to write to, whether it is permanent, whether it is your key or your project or your Google account, and whether anything else of yours is affected. We cannot establish any of that from any file we hold, so we are not going to say it. There is exactly one sentence about appealing anything in all 3,301,055 bytes we searched, it is quoted in full below, and it is not about this.

The two rows, verbatim, and where they sit

Read out of a stored copy of the Gemini API reference for generateContent. Google’s order, unaltered:

ESCALATION Request was filtered by an escalation rule.

PUP_LIMITED_DISABLED Indicates that token generation stopped because the user account is limited or disabled due to Prohibited Use Policy (PUP) violations.

They are not two rows gathered from two places in the file. They are the tail of the enum: one contiguous 210-character run, ESCALATION first, and PUP_LIMITED_DISABLED is the final row of the table — the next heading in the document is an unrelated type, GroundingAttribution. The row immediately before them is:

MALFORMED_RESPONSE Finished due to malformed response.

Here is the whole enum as this page re-parsed it out of the stored bytes, in source order. This list is ours — the numbering, and the act of listing the names without their descriptions, is our arrangement of Google’s table and not something the file states:

1 FINISH_REASON_UNSPECIFIED 2 STOP 3 MAX_TOKENS 4 SAFETY 5 RECITATION 6 LANGUAGE 7 OTHER 8 BLOCKLIST 9 PROHIBITED_CONTENT 10 SPII 11 MALFORMED_FUNCTION_CALL 12 IMAGE_SAFETY 13 IMAGE_PROHIBITED_CONTENT 14 IMAGE_OTHER 15 NO_IMAGE 16 IMAGE_RECITATION 17 UNEXPECTED_TOOL_CALL 18 TOO_MANY_TOOL_CALLS 19 MISSING_THOUGHT_SIGNATURE 20 MALFORMED_RESPONSE 21 ESCALATION 22 PUP_LIMITED_DISABLED

Why that matters more than it looks. Position in an enum is not meaning, and we are not claiming Google grouped these two deliberately. But it is the one checkable thing about them, and it has one practical consequence. The entries every tutorial covers (STOP, MAX_TOKENS, SAFETY) sit at the head of the list; if your client library carries a hand-written enum or a match statement over stop reasons, the tail is where it falls off the end. That is our inference and not documentation, we read no SDK source in any language to check it, and we are not claiming from position that these two rows are newer than the others — a table’s order is not a timeline.

Neither of these can mean “my prompt was refused”

This is the one thing the bytes settle cleanly, and it is worth knowing before you go looking for a prompt to rewrite. Gemini has two stop enums in this one file. The second is BlockReason:

Specifies the reason why the prompt was blocked.

and the field that carries it is documented in full as:

Optional. If set, the prompt was blocked and no candidates are returned. Rephrase the prompt.

Its six values, re-parsed from the same file, are BLOCK_REASON_UNSPECIFIED, SAFETY, OTHER, BLOCKLIST, PROHIBITED_CONTENT, IMAGE_SAFETY. Neither ESCALATION nor PUP_LIMITED_DISABLED is among them. Several other Gemini stop strings are in both enums, which is a real source of confusion and has its own page here; these two are not part of that problem. So “Rephrase the prompt.”, which is Google’s own instruction for the prompt side, is not advice that reaches either of these values, and a response carrying one of them had a candidate in it.

`PUP_LIMITED_DISABLED`: the only row in the reference that is about you

Hold the sentence against every other row in that twenty-two-value table and one thing stands out. The others are about the model, the request, the tools, the output. This one is about an account, and that word is almost absent from the document:

The whole-token string account occurs two times in the 1,232,462-byte reference. One of the two is in this row. The other is in a different enum entirely — a list of safety-policy names — and reads “Safety policy for account creation.” That is a safety-policy name in an unrelated enum, not a statement about anyone’s access.
So this row is the only place in the entire generateContent reference where the caller’s own account is mentioned at all, and accounts plural occurs zero times. So no account object and no account-state field is described under that word — which is what the search establishes, and is narrower than saying none exists.
Grepping for the other word in the sentence does not help either. disabled occurs five times in the reference, and four of those are one unrelated boolean on live-audio activity detection: “Optional. If enabled (the default), detected voice and text input count as activity. If disabled, the client must send activity signals.” If you searched the reference for disabled hoping for more on this value, that is what you found.

What the sentence does establish. Three things, and they are worth separating because only the first two are about the API at all. First: token generation stopped — so whatever else is true, this is a stop reason on a candidate and not a transport failure. Second: the stated cause is a state, not an event in your request — the account “is limited or disabled”. Third: the stated grounds are Prohibited Use Policy violations.

Note the “or”, because it is doing real work. Limited and disabled are plainly two different conditions, and one string covers both. The value cannot tell you which of the two you are in, and the reference describes neither. That is our reading of the word or, and it is the kind of distinction that would matter a great deal to someone reading this in a log at the wrong hour.

The policy is real, it is named, and it is not in any file we hold

The row names “Prohibited Use Policy (PUP)”, and that is not an invented name. We hold Google’s Terms of Service, 608,494 bytes, and it names the policy once:

Our service-specific additional terms and policies, such as our Generative AI Prohibited Use Policy, provide additional details about appropriate conduct that everyone using those services must follow.

What we can say from that, and the join we are making. The Terms call it the “Generative AI Prohibited Use Policy”; the enum row calls it the “Prohibited Use Policy (PUP)”. Those are not the same string, and treating them as the same document is our inference, from the words they share and from the fact that the enum row belongs to a generative-AI API. It is a reasonable inference and we would act on it. It is not something either file states.

And then the documentation stops. The Terms sentence is a link to that policy, and we did not follow it — no request left this machine to write this page. So the policy itself is not among the files behind this page, which means this page cannot tell you which clause of it applies to you, what conduct it covers, or what it says about enforcement. We think a reader deserves to know exactly where the trail we followed ends, and it ends here: the enum names a policy, the Terms name the same policy differently and link it, and that link is as far as these files go.

The appeal sentence — and why we will not hand it to you as the answer

This is the near-miss on this page, and it is worth showing rather than hiding. Searching all 3,301,055 bytes for the word appeal returns exactly one occurrence. It is in the Terms of Service, in a passage about accounts being closed:

For more information about why we disable accounts and what happens when we do, see this Help Center page. If you believe your Google Account has been suspended or terminated in error, you can appeal.

That is an appeal path for a Google Account, in Google’s general consumer Terms of Service, and nothing in any file we hold connects it to this enum value. It would have been very easy — and it would have read as helpful — to put that sentence under a heading like “how to get your access back”. We are not doing it, for reasons that are specific rather than squeamish:

The row says “the user account”. It does not say which. An API key, a Cloud project, a billing account and a Google Account are four different things, and the reference describes none of them. We cannot tell you which one the row means, and neither can these files — which is not the same as saying they are all the same thing.
The Terms passage is about disabling a Google Account. The enum row is about token generation on an API. Whether one implies the other is exactly the question, and quoting the Terms at you would look like an answer to it while being a change of subject.
The string PUP_LIMITED_DISABLED occurs zero times in the Terms, in the troubleshooting guide, and in the safety-settings guide. The only document we hold that mentions it is the enum table itself.

If you are holding this value, that Terms sentence and its Help Center link are a reasonable place for you to start. We are telling you where it came from and what it is about so you can judge that yourself, rather than presenting it as a documented remedy for a string it has never been documented against.

`ESCALATION`: a sentence that defines nothing, and a framing it does not support

The row, again:

ESCALATION Request was filtered by an escalation rule.

“Request was filtered by an escalation rule.” is circular in the ordinary way — an escalation rule is not defined, here or anywhere in the files behind this page. It does not say who set the rule, what it matched on, whether it is specific to you, your organisation, your model or your content, whether it is permanent, or whether a different request would miss it. The lowercase word escalation, counted as a substring and ignoring case so that a field name like escalationRule would be caught, occurs two times in the whole 1,232,462-byte reference — the value’s own name, and this one sentence — and zero times in the other three documents. There is therefore no field anywhere in that reference with escalation in its name: nothing to inspect, and nothing to turn off.

We are going to correct a framing here, including one of our own. It is natural to pair this value with PUP_LIMITED_DISABLED as “things that happened to you from outside your request” — and that is how this page was first conceived. But read the sentence: it begins “Request was filtered…”. Its own grammar is request-side. What the row establishes is that a filter fired and generation stopped. It does not establish that the rule is about your account, your identity or your history, and it does not establish that it is about your content either. The row is too thin to place the cause anywhere, and anyone who tells you it is account-level — us included, had we written that — is inferring past the sentence.

So why is it on the same page? For a property that is checkable rather than interpretive: neither row names anything you control. Our reading of the other twenty rows, and the listing above is there so you can check it, is that every one of them points at some part of the exchange — the prompt, the tools, the output, the token budget, the schema. These two point at an account state and at an unnamed rule, and in both cases the documented request object contains no field that affects them. That, plus their adjacency in the table, is the whole of our reason for putting them together. It is a weaker claim than “both are about your access” and it is the one the bytes support.

No HTTP status, no retry rule, and the document that would have them is one we did not fetch

Here is the shape of the gap, stated precisely, because this is where a reader is most likely to be handed a guess by somebody else.

The whole-token string retry occurs zero times in the 1,232,462-byte reference. So does PERMISSION_DENIED, and so does quota. The numerals 400, 401, 403, 429, 500 and 503 occur zero times in it, and its three occurrences of HTTP are all about MCP transports and a timeout. So the reference maps no stop value to any status code because it carries no status codes at all.
The troubleshooting guide — 105,225 bytes, the one document here designed for things going wrong — contains the word retry eight times and the string finishReason zero times. It does not discuss this channel at all. Its retry advice is written against HTTP status codes: “If you receive an error indicating that you should retry your request (such as a 429 RESOURCE_EXHAUSTED or 503 UNAVAILABLE), we recommend implementing an exponential backoff strategy.” and, on the non-transient side, “Only retry on transient errors (like 429, 408, or 5xx). Do not retry on client errors (like 400, 402, or 403) as they indicate issues like invalid API keys, depleted Prepay credits, or bad syntax.” Neither of these two values appears in it, and neither appears among the conditions those codes are said to indicate.
That guide points somewhere we did not go:

Error codes For a complete reference of all error codes, including HTTP status codes, generation blocked codes, and content error codes, see the API errors page.

We did not fetch that page, so if a status code or an enforcement note for either of these values is documented by Google, that is a likely place for it and this page is not evidence against its existence. Every claim of absence here is a claim about the five files named at the bottom, on the dates they were fetched — not a claim about everything Google has published.

On retrying, one labelled inference and one refusal. For PUP_LIMITED_DISABLED: the row attributes the stop to a state of the account, and resending an identical request does not change a state, so our reading is that a retry loop will reproduce it rather than resolve it. That is reasoning from the sentence, not documentation, and we have labelled it as such. For ESCALATION: we have no idea, the row supports no reading either way, and a backoff loop against it is an experiment.

The one field that may carry more, and what to do with the string you have

If you are holding either value, there is exactly one place in the documented response where the API is permitted to elaborate, and it is on the candidate:

Optional. Output only. Details the reason why the model stopped generating tokens. This is populated only when finishReason is set.

Read it and log it. We have no captured response carrying either of these values — we hold reference documents, not traffic — so we cannot tell you what finishMessage contains for them, and the row promises only that it is populated, not that it is informative. It is still the only channel the documented schema has for the detail these two rows omit. Code that logs finishReason and discards finishMessage is throwing away the only sentence that might not be circular.

cand = (resp.get("candidates") or [{}])[0] fr = cand.get("finishReason") if fr in ("PUP_LIMITED_DISABLED", "ESCALATION"): # not a transport error and not a prompt problem: do NOT feed this to the backoff loop log.error("gemini: stopped with no lever. field=candidates[0].finishReason " "value=%s message=%s", fr, cand.get("finishMessage")) raise NeedsAHuman(fr)

That block is ours. No file behind this page contains a code sample that inspects a finishReason, a logging recommendation, or any handling guidance for either value. The one documented thing it rests on is the quote above: finishMessage exists and is populated when finishReason is set. The decision to route these two away from a retry loop and at a person is the labelled inference from the section above, and the exception name is a joke about the honest state of the documentation.

Four questions this page cannot answer

Which account — the API key, the project, or the Google Account? We cannot tell you, and neither can these files — which is not the same as “they are all the same thing”. The row says “the user account” and the reference contains no other mention of an account belonging to the caller.
Is it permanent, and how is it appealed? Nothing in these files says. The one appeal sentence we found is quoted above, with our reasons for not treating it as the answer. We looked; the search is the only reason we can say this much, and we are not asserting it is undocumented elsewhere.
What is an escalation rule? Undefined in every file behind this page. Not “we think it means X” — undefined.
What HTTP status, and does the request get billed? The reference carries no status codes, as counted above, and the words billed, billing, charged and charge occur zero times in it. The errors page quoted above is the documented place to look and we did not read it.

What this page does and does not claim

Claimed, from quoted rows: both values exist in FinishReason; they are its final two entries, adjacent, in that order, after MALFORMED_RESPONSE; neither is a BlockReason value, so neither can arrive on promptFeedback.blockReason; the PUP_LIMITED_DISABLED row attributes the stop to an account being limited or disabled on Prohibited Use Policy grounds; Google’s Terms of Service name a Generative AI Prohibited Use Policy; a candidate carries finishMessage.
Claimed, as ours and labelled in the sentence: that the policy the Terms name and the policy the enum names are the same document; that “limited or disabled” is two conditions under one string; that a retry cannot change an account state; that the two belong on one page because neither names anything you control; the enum listing, the code block, and the remark about hand-written enums falling off the tail of the table.
Not claimed: any appeal path, contact, form, timeline, scope or permanence for PUP_LIMITED_DISABLED. Not which account object it refers to. Not whether other Google services are affected. The files behind this page support none of it and we have not supplied it from memory.
Not claimed: any meaning for ESCALATION beyond “a filter fired”, including the plausible-sounding reading that it is account-level or abuse-related.
Not claimed: that the Terms of Service appeal sentence applies to this value, and not that it does not.
Not claimed: anything about SDK behaviour. We read no client-library source in any language, so whether yours raises, returns an unknown-enum sentinel, or crashes on these two strings is outside everything we checked.

Provenance

Every sentence inside a quote block above was read out of a copy of the document it is attributed to that was already stored in this lab’s repository before this page was written. Nothing was fetched to write this page — not one request left the machine — and nothing here is quoted from memory. With the byte count of the file actually read:

Gemini API reference, generateContent — 1,232,462 bytes, fetched 4 October 2026 at HTTP 200, carrying its own date Last updated 2026-09-23 UTC. The source of both rows, both enums and every field description above.
A second copy of that same reference — 1,232,466 bytes, same URL, fetched the same day about ninety minutes earlier, same internal date. It is 4 bytes longer than the copy above. This is a finding, not a typo. That document is edited under us, so any byte count anyone quotes for it is true only of a dated copy. Both rows on this page were checked against both copies and are byte-identical in each, so the drift did not touch them — but it is the reason this page cites the size of the file it read rather than a size for “the page”.
Google Terms of Service — 608,494 bytes, fetched 4 October 2026, carrying “Effective July 30, 2026”. The source of the policy name and the appeal sentence. Unlike the others it carries no Last updated … UTC line and no Creative Commons notice; both quotes from it are short excerpts.
Gemini API docs, Troubleshooting — 105,225 bytes, Last updated 2026-10-01 UTC. The source of the retry advice we declined to transplant and of the pointer to the errors page we did not fetch.
Gemini API docs, Safety settings — 122,408 bytes, Last updated 2026-09-17 UTC. Searched, and it contains neither value.

The reference, its second copy, the troubleshooting guide and the safety-settings guide each carry the same licence line: “Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License”.

The counts. Searched across those five files, tags stripped, whitespace collapsed, whole-token matches only — so PUP_LIMITED_DISABLED is not counted as an occurrence of PUP, and account does not count accounts. Columns are the reference, its second copy, the Terms of Service, the troubleshooting guide, the safety-settings guide. The first five lines are the whole argument of this page: each value occurs exactly once, in the reference, in both copies of it, and nowhere else at all.

ref fin tos tro saf PUP_LIMITED_DISABLED 1 1 0 0 0 ESCALATION 1 1 0 0 0 PUP 1 1 0 0 0 escalation 1 1 0 0 0 account 2 2 4 1 0 accounts 0 0 2 0 0 suspended 0 0 1 0 0 terminated 0 0 1 0 0 appeal 0 0 1 0 0 disabled 5 5 0 0 0 limited 2 2 5 1 0 finishReason 6 6 0 0 2 finishMessage 2 2 0 0 0 blockReason 2 2 0 0 1 retry 0 0 0 8 0 RESOURCE_EXHAUSTED 0 0 0 1 0 PERMISSION_DENIED 0 0 0 0 0 quota 0 0 0 0 0 Prohibited 1 1 1 0 0

Read off that table: appeal, suspended and terminated are zero in the reference and occur only in the Terms of Service, which is the evidence for the whole of the appeal section above. account is two in the reference, one of them in the row this page is about. retry is zero there and eight in the troubleshooting guide, none of it about either value. PERMISSION_DENIED and quota are zero everywhere, which is why this page offers no status code. The two columns for the reference are identical on every line, which is the check that the 4-byte difference between the copies does not touch anything quoted here.

Those counts are the evidence for every claim of absence on this page. We captured no live API response, we read no SDK source, we did not follow a single link out of these five files — including the two that matter most, the Prohibited Use Policy itself and the API errors page. Where this page reasons past the documentation it says so in the sentence that does it.

There is a written guide: the full finishReason and BlockReason dispatch as one table you can hold against your own response handler, including the tail of the enum that hand-written matches tend to miss, and which values are worth a retry at all.

No page on this site has a checkout widget of its own. There is a written guide behind this host and it is on sale at $19 on a storefront that delivers the files automatically and carries a 30-day money-back guarantee: buy it there; the guide can also be paid for with 19 USDC on Base at the payment page, where delivery is by hand as a reply to your email. Every page on this site, including this one, is free to read in full, with no sign-up and nothing gated.

The short version: ESCALATION and PUP_LIMITED_DISABLED are the final two rows of Gemini’s twenty-two-value FinishReason enum and neither exists in BlockReason, so neither can mean your prompt was refused and neither is fixed by rephrasing. PUP_LIMITED_DISABLED attributes the stop to an account that is “limited or disabled” on Prohibited Use Policy grounds — the only mention of the caller’s account in the whole reference — and the policy it names is not in any file behind this page, so what to do about it is a question this page cannot answer, and the one appeal sentence we found is about a Google Account and not about this. ESCALATION says only that “Request was filtered by an escalation rule.”, defines nothing in that sentence, and does not even establish whether the rule is about you. Log finishMessage alongside the value; it is the only field that might say more.

Nearby

finishReason: SAFETY, RECITATION, OTHER — the Gemini stop values whose documentation defines them using their own names. ESCALATION has the same defect in a harder form, and MALFORMED_RESPONSE, the row immediately before these two, is one of the eleven that page covers.
blockReason vs finishReason: the five values in both enums — the field-versus-value problem. Worth reading for the contrast: these two values are in exactly one enum, which is what lets this page say so plainly that neither is about your prompt.
Gemini returned no image: the five image values — another contiguous block of the same enum, where the rows do at least name what was rejected.
finishReason: MISSING_THOUGHT_SIGNATURE — three rows earlier in the table, and the opposite case: a stop value that points at something precise in your request that you can go and fix.
stop_reason: max_tokens — another vendor, and the kind of stop value this pair is not: a documented cap with a documented remedy.

This page counts anonymous readership, and it carries one counter rather than the two that the older pages on this host carry. Each load sends the page path, the address of the page you came from, how long the page was open, whether you scrolled, and any campaign or outreach code in the link you followed; a second “engaged” event is sent once, ten seconds after the page opens — whether or not the tab is in front of you — or as soon as you scroll a quarter of it. The campaign codes from the first link you arrived on are kept in this browser’s local storage, and a later visit that arrives with no codes of its own is counted against them; a link carrying its own codes is used for that visit, and the stored first touch is never replaced. An outreach code is removed from the address bar after it is read. Because this page sends one view event rather than two, a view count taken from it is directly comparable to a load, which is not true of the sixteen pages on this host that send two — any rate measured against those reads half its true value. No name is attached to any of this: the only identifier the code can send is an outreach token minted per recipient, and no link carrying one has ever been sent for this page. No cookie; the local storage above does that job. The page also asks this domain for an analytics script at /_vercel/insights/script.js; on 26 September 2026 that address returned HTTP 404 on every host we publish, so no script from another company was served or ran — the page goes on asking, so this stops being true the moment that address starts answering, without a byte of this page changing. Your browser and the network attach things the page does not send: the identification string your browser gives, your IP address and the time of the request. The host that serves this page keeps its own request logs; those are its record and not ours.

Gemini finishReason: PUP_LIMITED_DISABLED and ESCALATION — the two rows with no lever in them