I have always seen country-code top level domains (ccTLDs) with sites like: example.ac.uk, example.co.uk, etc.
Do the country-code top level domains always only allow sites on these third level domains, or it is possible to have a ccTLDs site on a second level domain like example.jp?
What counts as available is defined by each individual ccTLD operator e.g. Nominet for .uk
... and those rules may change over time e.g. Nominet recently started to open example.uk as introduced here, whereas previously only the third level example.co.uk, example.org.uk, etc was available.
You can find the de facto standard list of domain suffixes here: https://publicsuffix.org/list/effective_tld_names.dat and more information about that list here
Everything is possible, in the sense that ccTLDs are free to organize their domain space in any way they want.
It is true that many of them at least started with subdomains (either using professional categories or separating individuals from organizations, or using geography like separating by counties/regions, see .IT for example), but the trend seems to either remove then or at least offer second level registration along side third levels (this was the case of .FR for example where second level was restricted to organizations, with .NOM.FR for individuals, and dozens of others for specific professions, where now .FR is directly open to all, and many third level ones were either closed or resold).
If you take the European market, the two biggest ones (.UK and .DE) are on the opposite side of the scale: .DE was always (as far as I know) second level only, while .UK was third level only and added second level in the last few years.
In ccTLD, it probably shows the earlier views on the DNS, when it was first invented and then deployed: people believed at that time that it could be an universal address book and that they would be clear categories, without ambiguities nor overlapping, so that everyone could fit simply in one specific spot. This was before realizing that some domains have more value than others just because humans see them that way, and that greediness will apply here just as anywhere else. And even before taking into accounts IDNs, variants and homeographic attacks (that happens even without IDNs). Which explains why multiple TLDs stopped these categorization attempts (and people have trouble understanding domain names with more than one dot in them) or soften them a lot. One can parallel this with X.400 specifically as used in X.509 certificates, with all the O, OU, L, ST, and then other extended attributes used to describe an organization in the early days of OV only certificated, but now with the godzille in the room of DV certificates, that do not even use the CN part of the subject anymore but just use a certificate structure to put everything, as just an hostname, in a specific extension (the SAN one).
You can see in https://www.rfc-editor.org/rfc/rfc1480 "The US Domain (June 1993)" an example of how some rules were decided at that time. Few excerpts:
The US Domain hierarchy is based on political geography. The basic
name space under US is the state name space, then the "locality" name space, (like a city, or county) then organization or computer name
and so on."FED" - This branch may be used for agencies of the federal government. For example: ..FED.US
"CI" - This branch is used for city government agencies and is a subdomain under the "locality" name (like Los Angeles). For example: Fire-Dept.CI.Los-Angeles.CA.US.
There are two reasons for registering schools in the US Domain. (1) uniqueness of names, and (2) management of the database. [..] For both these reasons it is necessary to introduce structure into names. Structure provides a basis for making common names unique in context, and for dividing the management responsibility.
For example: Hamilton.LA-Unified.K12.CA.US
In the long run, such an highly hierarchical setup hugely failed, and .US reverted to a "standard" "flat" namespace, when Neustar was designated to run it.
So in short there is no generic rules, neither in space nor in time.
Even in gTLDs, you find examples. When .NAME started, it was only firstname.lastname.NAME (or lastname.firstname.NAME), which created major headaches for registrars (the registry sold an MX service for the second level, whose expiration date was not aligned with the underlying domain name...) and low appetite from customers (not understanding this structure of names), without even taking into account that not everyone has a firstname and a lastname.
