a) Person A --> granted provisional access to the system -> legal
b) Person A sells the access to the system to person B -> illegal, misuse of access by sale of credentials or access codes. Can fall under access fraud. Also illegal if "making available of" (distributing) credentials without authorization of site owner per ToS (again provisional access requires that rules be followed)
c) Person B accesses the system -> illegal, computer fraud, access fraud, and theft of service.
I see it differently, since you're mixing in ToS. And that's contract law.
Again provisional access requires that rules be followed hence why you don't see CIA analysts, investment bankers, or employees selling their access credentials. If you do you face criminal and civil liability. The law of most nations respects this and is codified as statutes under judicial law. You can ignore it, that's fine by me, it doesn't mean you won't face criminal and civil penalties.