In addition to the rules laid out by msebas, there are several other relevant provisions of the Vienna Convention.
For starters, the sending state can't unilaterally declare any citizen of the receiving state a member of the diplomatic delegation (which could otherwise be abused in cases of kidnapping or asylum):
Members of the diplomatic staff of the mission may not be appointed from among persons having the nationality of the receiving State, except with the consent of that State which may be withdrawn at any time.
(Article 8)
The same article also permits the receiving state to "reserve the same right with regard to nationals of a third State who are not also nationals of the sending State." This is why (for example) Ecuador was unable to appoint Julian Assange to a diplomatic post in order to exfiltrate him from their embassy in London.
The sending state can waive any and all immunity:
The immunity from jurisdiction of diplomatic agents and of persons enjoying immunity under article 37 [i.e. family members, support staff, etc.] may be waived by the sending State.
(Article 32)
They are generally expected to do this if any diplomatic agent appears guilty of a serious crime. Failure to waive immunity implies endorsement of the illegal act, and may have serious diplomatic consequences.
The diplomatic mission is not supposed to be used for doing illegal things, which presumably includes kidnapping:
Without prejudice to their privileges and immunities, it is the duty of all persons enjoying such privileges and immunities to respect the laws and regulations of the receiving State. They also have a duty not to interfere in the internal affairs of that State.
[...]
The premises of the mission must not be used in any manner incompatible with the functions of the mission as laid down in the present Convention or by other rules of general international law or by any special agreements in force between the sending and the receiving State.
(Article 41)
Even breaking diplomatic ties outright would be insufficient to remove immunity from the grounds of the mission:
If diplomatic relations are broken off between two States, or if a mission is permanently or temporarily recalled:
(a) The receiving State must, even in case of armed conflict, respect and protect the premises of the mission, together with its property and archives;
(Article 45)
However, Article 39 provides that:
When the functions of a person enjoying privileges and immunities have come to an end, such privileges and immunities shall normally cease at the moment when he leaves the country, or on expiry of a reasonable period in which to do so, but shall subsist until that time, even in case of armed conflict. However, with respect to acts performed by such a person in the exercise of his functions as a member of the mission, immunity shall continue to subsist.
So in the event of a diplomatic break, the members of the mission would need to leave the country within a "reasonable period of time" or they lose their immunity and could be arrested for kidnapping. At that point, the victim can presumably walk out.
Unnamed Turkish officials are now alleging that the Saudis murdered Mr. Khashoggi, which the Saudis promptly denied. Neither side appears to have offered any hard evidence so far (despite what the Washington Post describes as a "thicket of security cameras around the consulate"), so I will not speculate on the veracity of these allegations. It is likely we will know the truth in the near future.
Nevertheless, as with the Skripal poisoning, if true this is potentially an act of war. Mr. Khashoggi's citizenship does not change that fact.
