NBG is a conservative extension of ZFC that includes a concept of "proper class." Now I like the conservativity, since it means anytime I want to prove something in ZFC, I am free to work in NBG. However, the NBG approach to proper classes isn't very "malleable;" e.g. we cannot have one proper class as an element of another proper class, we cannot exponentiate proper classes etc.


So what I'd like is a (material) set theory with proper classes that can be manipulated as if they were sets, which is nonetheless *conservative* over the language of ZFC. Is this possible? Somehow we have to block the "consistency theorem" for proper class sized models; if $V$ is the proper class of all sets and $\in$ is the membership relation on $V$, then despite that $(V,\in)$ is a model of ZFC, nonetheless we don't want to deduce that ZFC is consistent, since this is a proper class model.



Can we have more malleable proper classes without sacrificing conservativity?
Yes, you can have a full ZFC-like hierarchy on top of the universe, with no consistency-strength penalty.


Consider the theory denoted ZFC + $V\_\kappa\prec V$, expressed in the language with an additional constant symbol $\kappa$, where $V\_\kappa\prec V$ denotes the scheme $$\forall x\in V\_\kappa\left[\varphi(x)\iff \varphi^{V\_\kappa}(x)\right].$$
Thus, the scheme $V\_\kappa\prec V$ expresses that $\kappa$ is a [correct](http://cantorsattic.info/Correct#Reflection_and_correctness) cardinal.


This theory lines up with your theory, if you think of the elements of $V\_\kappa$ as the real "sets" and the elements of rank $\kappa$ and higher as the classes and meta-classes and so on. 


**Theorem.** The theory ZFC+$V\_\kappa\prec V$ is equiconsistent with ZFC. Indeed, every model $M\models\text{ZFC}$ has an elementary embedding $M\prec V\_\kappa^{\bar M}$ into a model $\bar M$ of the theory, so that $V\_\kappa^{\bar M}\prec \bar M$. 


Proof. This is a simple compactness argument, applied with the reflection theorem. Let $T$ be the theory that augments the elementary diagram of $M$ with the assertions $a\in V\_\kappa$ for each $a\in M$ and $\forall x\in V\_\kappa[\varphi(x)\iff\varphi^{V\_\kappa}(x)]$. It follows by reflection that every finite subtheory of $T$ is realized inside $M$, and so $T$ is consistent. Any model of $T$ provides the desired $\bar M$. QED


Thus, the theory is conservative over ZFC, and proves no new facts about "sets", since anything true in any model $M$ of ZFC is also true in the sets, that is in $V\_\kappa$, of a model of ZFC+$V\_\kappa\prec V$.


By essentially the same argument, one can get a transfinite tower of such elementary substructures $V\_\kappa\prec V\_\lambda\prec V$ for all $\kappa,\lambda\in C$, where $C$ is a closed unbounded class of cardinals. This is known as the [Feferman theory](http://cantorsattic.info/Reflecting#The_Feferman_theory). 


This idea has appeared here on MO a few times, such as in [my answer concerning various weak universe concepts](https://mathoverflow.net/a/28913/1946), [an answer by François Dorais](https://mathoverflow.net/a/81711/1946), [another](https://mathoverflow.net/a/63432/1946), and (probably the most relevant) [my answer about elementary substructures of the universe](https://mathoverflow.net/a/103779/1946). 


Note one subtle issue of the theory here, though, is that $\kappa$ might be singular. To insist that $\kappa$ is regular will imply that it is inaccessible, and this then will no longer be a conservative extension. If you want $V\_\kappa\prec V$ where $\kappa$ is inaccessible, then this is called a [reflecting](http://cantorsattic.info/Reflecting) cardinal, which is equiconsistent with and conservative over the theory known as [Ord is Mahlo](http://cantorsattic.info/ORD_is_Mahlo). Every model of Ord is Mahlo elementarily embeds into the rank initial segment $V\_\kappa$ of a reflecting cardinal $\kappa$ inside a model of $V\_\kappa\prec V+\kappa$ inaccessible.


Another subtle point addresses your concern at the end. Namely, even though $V\_\kappa\prec V\models\text{ZFC}$, you cannot deduce from this that $V$ knows $\text{Con}(\text{ZFC})$, since you only have $V\_\kappa\prec V$ as a scheme. You don't have any statement from which you can conclude in $V$ that $V\_\kappa$ satisfies all the ZFC axioms, only that it satisfies each particular axiom in the the meta-theory. But this is exactly parallel to the situation with sets and classes in ordinary ZFC, where we cannot generally even state that $L$ satisfies all of ZFC, only that it satisfies each particular axiom of ZFC expressible in the meta-theory.


