Those permissions could be handled only with one checkbox. Checked - allowed, unchecked - Full Control denied, for example.
Why two checkboxes, not one? Also why not radio buttons?
This is an excellent question. From the looks of it, there's no reason for all this complexity. However, once you dive a bit deeper, you realize that this is actually a simple solution for the underlying logic, which is incredibly complex.
First of all - note that you can have both Allow and Deny empty. Meaning that "Not allowed" is not the same as "Denied". This may sound absurd to people unfamiliar with IT Access management, but that's how it is. It has to do with access levels architecture, group inheritance etc.
There are many dependencies between the controls. For instance, if you mark Full Control it will also mark both checkboxes in that column, and if you mark Change it will also mark Read. The dependencies work top-down, but not always, and in some cases also have some effect bottom-up. Changing a row from Allow to Deny will sometimes have unexpected (or at least not immediately intuitive) effects on both columns.
For instance, marking Allow for "Read & Execute" also marks "List folder contents" and "Read", but clearing "Read & Execute" doesn't affect the other two - they stay checked. However, setting "Read & Execute" to "Deny" sets the other two to Deny as well.
I've recorded a very short clip to illustrate this. Mine has a bit more permission than yours, and I suspect that more complex situations are possible in organizational settings.
I'm not sure that there's no way to solve this with radio buttons, but I'm pretty sure that even if it's possible, it will be much more difficult to understand.
This is a wonderful example of a UX solution that seems to violate every possible UX guideline, but once you get down to it, a better solution proves to be very challenging to find.