diff --git a/docs/spec.rst b/docs/spec.rst
index 2dfc33f..2de5aa1 100644
--- a/docs/spec.rst
+++ b/docs/spec.rst
@@ -120,3 +120,12 @@
                       .EncryptedPayload = ContentKey encrypted by public key /[access-namespace]/NAC/[dataset]/KEK/[key-id]
                       // .InitializationVector, .EncryptedPayloadKey, and .Name are not set
                     )
+
+Decryptor
+---------
+
+.. figure:: _static/decryptor.png
+   :alt: Decryptor
+   :align: center
+
+Encryptor decrypts (asynchronous operation, contingent on successful retrieval of CK data, KDK, and decryption of both) the supplied ``EncryptedContent`` element.