Right now, an ArcGIS Online administrator can create custom roles that prevent users from being able to generate a Tile Layer. This is good because it prevents inexperienced users from inadvertently using a load of credits by generating a large number of tiles directly in ArcGIS Online.
However, a Desktop user can now generate a tile package offline, then push it to a Tile Layer in ArcGIS Online without using credits for tile generation (because the tiles are generated locally). But, if an administrator has limited an AGO user so they cannot generate a Tile Layer, then these users can push the tile package to Online but they cannot create the needed Tile Layer.
It would be nice if there was a role that allowed users to NOT generate tiles directly in ArcGIS Online, but still allowed them to publish a Tile Layer from an uploaded tile package.