This is going to be simplified, to try and illustrate.
Any account can call any function of any smart contract by sending a transaction that calls a function. When you send such a "function call" transaction, the code in that function "comes to life" and executes itself.
Typically, the first thing that the function does is to check if the account calling it is authorized to call it. And if it isn't, the function fails / rolls back the transaction (by calling "revert").
In your example, imagine the following flow:
- You (or anyone) creates the contract by loading it onto the chain (in a "create" transaction). You add Address B to the contract as an authorized withdrawer.
- You send 1 ETH to the contract. The contract now has a balance of 1 ETH.
- Account B calls your custom "withdraw" function on the contract. The withdraw function first checks to make sure Account B is authorized to withdraw, then uses the built-in solidity "send" function to send ether to Address B.
Solidity abstracts away the transaction's signature, so you can always trust the value of msg.sender
.
Like I said this is pretty oversimplified so there are a couple of important small technical things glossed over, but it gives you the basic gist.