How exactly army treated citizens depended on multiple factors and didn’t die out with the Middle Ages: same rules applied for many centuries before modern chain of command structure with harsh discipline was developed, as even in 17-18 centuries it was almost impossible to stop enraged soldiers from pillaging the town in case they had decided to do so.

Generally, rules of engagement for many nations and time periods were formed by different questions one could ask themselves when they thought what to do with the city after they captured it.

1. Did the city surrender immediately?
2. Did the city surrender eventually?
3. Were there any “dishobourable” acts from your opponents?
4. Are there any valuable possessions or persons you are afraid to destroy?
5. Are you ordered to wage total war and take no prisoners?

Unless a commander was extremely bloodthirsty or incapable man unable to hold off his troops from killing and looting the town, inhabitants could expect to be treated relatively well if they surrendered. Surrendering outright was usually the go to method for the highest chances of survival. Even if the enemy wasted a lot of time and resources to subdue them, it is still possible for the garrison and citizens to sign a ceasefire and leave the town unmolested (example: siege of Rhodes in 1522 by the Ottoman empire). Same could also be applied if the capitulation could mean de facto end of the war (surrender of the English army at Bordeaux in 1453). But in case a city would enrage opposing forces by the stiffness of its resistance or besieging army would have orders to pillage and destroy everything, then population would face grim fate of being killed, enslaved or at the very least robbed. Mongols were infamous for completely annihilating towns which opposed them killing majority of citizens in the process (siege of Baghdad, 1258). Same was true for the Croat raiding parties during the Thirty Years War who pillaged many small towns and villages in Germany.

In case the city had been offered surrender terms several times but had declined all of them and was still captured, it would still face acts of pillage and uncontrollable murder (for example, siege of Smolensk by Russian army in 1654).

In case the city surrenders and is treated well, there are usually several restrictions besiegers enact in order to retain control over the populace:

1. Deploying garrison to maintain order.
2. Allowing newly appointed governor to control the city.
3. Restricting citizens from going to the still territory still occupied by the enemy, essentially keeping them under new jurisdiction.

In case the city revolts, harsh prosecutions could still be applied even if the city later surrendered. Even in case of relatively peaceful takeover victors could still cause grief to the populace unless watched closely. So even in the best case scenario this treatment was usually far from being excellent.