thedailybeast.com/embassy-staffe…
This means they have to keep the COM informed of their activities and follow the COM's directives, especially re: security.
uscode.house.gov/view.xhtml?req…
fam.state.gov/searchapps/vie…
Where there is no U.S. ambassador, as is currently the case in Saudi Arabia, COM authority is exercised by the charge d'affaires, who is usually the most senior career diplomat at post.
Needless to say, neither applies to Kushner or his entourage.
But absent a directive from President Trump exempting Kushner's activity, it should be under COM authority.
When there is a major security incident (like an attack or intelligence breach), the State Department is required to convene an Accountability Review Board (ARB) and report the results to Congress.
law.cornell.edu/uscode/text/22…
fam.state.gov/fam/12fam/12fa…
That's why I always advised COMs to clarify lines of responsibility in writing.