Use Volatility 3 when an agent needs to extract evidence from a captured memory image and turn it into concrete forensic findings such as process listings, loaded modules, network artifacts, and suspicious runtime indicators. A user should invoke this instead of using the project generically when the job is bounded memory-image triage for investigation or incident response, not general security tooling exploration. The scope boundary is clear and skill-shaped: offline volatile-memory analysis from a supplied sample into reviewable findings, not a plain framework listing.