I have a protected hierarchical custom setting that my app uses internally, and I'm interested in making it available via a global apex class to be edited outside our namespace, but with the apex class doing validation to ensure the provided values are "safe".

I've tried making a global apex class in the same namespace as the protected setting and I get a "permission denied" error when trying to call the class's save method to update the settings. Is there a way to do this?

It would make sense that my class in the same namespace as the setting could modify it even if it was initially called by a different namespace, correct?

Apex class in the publishing org (that contains the setting):

global with sharing class BaseSettings {
	private static BaseSettings instance = null;
	@deprecated global IncidentSettings__c incidentSettings {get; set;} 
	public static boolean isTest = false;
	//Load the default values for the sake of our testing.
	public static void isTest(boolean value){
		isTest = value;
	}
	
	private BaseSettings(){
		if(isTest){
			incidentSettings = new IncidentSettings__c();
		} else {
			initIncidentSettings();
		}
	}
	
	global static BaseSettings getInstance(){
		if(instance == null){
			instance = new BaseSettings();
		}
		return instance;
	}
	
	//Used by the constructor
	private void initIncidentSettings(){
		incidentSettings = IncidentSettings__c.getInstance();
		if(incidentSettings == null){
			incidentSettings = new IncidentSettings__c();
		}
	}

	global void save(){
		upsert incidentSettings;
	}
	
	global boolean getIncidentBlockReopen(){
		return incidentSettings.blockReopen__c;
	}
	global void setIncidentBlockReopen(boolean value){
		incidentSettings.blockReopen__c = value;
	}
	
	global boolean getIncidentOwnerCloseOnly(){
		return incidentSettings.ownerCloseOnly__c;
	}
	global void setIncidentOwnerCloseOnly(boolean value){
		incidentSettings.ownerCloseOnly__c = value;
	}
	
}

Apex class in the customer org trying to use the settings class:

public with sharing class SettingsController {
        public itil_b.Settings baseSettings {get; set;}
        
        public SettingsController(){
                baseSettings = itil_b.Settings.getInstance(); 
        }
        
}

And finally the vf page, which works until I hit save, at which point I get a generic "Insufficient Privileges" error.

<apex:page controller="SettingsController">
  <apex:form>
      <apex:outputLabel value="Incident Onwer Close Only" />
      <apex:inputCheckbox value="{!baseSettings.incidentOwnerCloseOnly}" />
      
      <apex:commandButton action="{!baseSettings.save}" value="Save" />
  </apex:form>
</apex:page>

Any Ideas?